WX Subscribe CVE-2026-91833

Exploitation requires that the target WordPress site has WX Subscribe (微信支付付费订阅) installed at version 1.2.1 or earlier AND that the plugin's WeChat payment key has NOT been configured - on installs with a configured payment key, the vulnerable code path is not reachable. This unconfigured-plugin requirement is the primary limiting factor and is reflected by AC:H. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any such unconfigured install is remotely reachable by an unauthenticated attacker; the realistic exploitable population is small because configured/production sites are not affected.

Signals are consistent and point to a real-but-moderate issue rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, base 6.8) describes a network-reachable, unauthenticated SQL injection, but with high attack complexity because exploitation is only possible on installs where the WeChat payment key has NOT been configured - a narrow, non-default precondition. EPSS is low at 0.18% (7th percentile), and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation. Exploitation status: publicly available exploit code exists (WPScan reference), which raises opportunistic risk, but POC availability is distinct from active exploitation and should not be conflated. No SSVC decision data was supplied in the input. The AC:H precondition plus low EPSS and absence of KEV suggests this is a lower-priority issue for most defenders - meaningful only for unconfigured/incompletely-onboarded installations. Note a defensible metric disagreement: the input uses S:C (scope change) for this SQLi, which inflates the base score; a plugin-level SQLi against the same WordPress database arguably warrants S:U - verify scope rationale with WPScan before treating 6.8 as authoritative.

An unauthenticated attacker locates a WordPress site running WX Subscribe (through 1.2.1) that has been installed but not yet fully configured - specifically where the WeChat payment key is unset - and sends a crafted request containing a malicious value in the vulnerable parameter. Because the input is used unsanitized in a SQL statement, the attacker injects SQL to read sensitive database contents such as user data or credentials hashes. A public proof-of-concept is referenced by WPScan, lowering the skill barrier, though the required unconfigured state limits the number of exploitable targets.