Comments Plugin CVE-2026-19704

No authentication is required and no special server-side configuration is needed - any WordPress site with the Comments plugin installed and active in a version prior to 7.6.66 is exposed via a standard HTTP request. The injection is bounded to altering comment-filter logic: the attacker can read comments in restricted statuses (pending, spam, trash) or attached to non-public posts, but cannot extract arbitrary tables, credentials, or secrets from the database. Exploitation is limited to sites where the plugin is active and processing user-supplied query parameters in its comment-listing logic.

The CVSS 3.1 score of 5.3 (C:L/I:N/A:N, AV:N/AC:L/PR:N/UI:N) accurately reflects the constrained impact: the vulnerability is trivially reachable over the network without authentication but yields only restricted comment content, not the full database. Real-world risk is moderate - the existence of publicly available exploit code (confirmed by WPScan) materially raises exploitation probability despite the absence of a CISA KEV listing, and an unauthenticated, low-complexity network vector means automated scanning and exploitation is feasible. The exposed data (draft post comments, spam, private post discussions) could contain sensitive internal communications, unreleased product information, or PII embedded in comment threads. A patch is available at version 7.6.66, and unpatched sites should be treated as at elevated risk given public exploit availability. No EPSS data was provided in the intelligence set, but the AV:N/AC:L/PR:N/UI:N profile is consistent with a moderately elevated exploitation likelihood. The limited integrity and availability impact (both N) means this is a data-disclosure issue, not a site-takeover path.

An unauthenticated attacker sends a crafted HTTP request to a WordPress site running the vulnerable Comments plugin, injecting SQL into the unvalidated parameter to alter the query's WHERE clause logic. The modified query returns comments that would ordinarily be hidden - including spam, trashed, moderation-queue, and private/draft-post comments - which the attacker reads from the HTTP response. Since WPScan has confirmed publicly available exploit code, this scenario requires minimal skill and can be automated across large numbers of sites.