EUVD-2026-11744Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious SQL payload in email parameter
-
ExploitSubmit request to getAllSubscriptions() function
-
ExecutionInject SQL code into database query
-
ImpactExtract sensitive data from WordPress database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | wpDiscuz plugin version before 7.6.47 installed and activated. getAllSubscriptions() function must be accessible via plugin endpoints. Requires network access to WordPress installation; no authentication needed. |
| Impact | Severity: High (8.1/10.0) No EPSS data available yet HIGH RISK: Remotely exploitable without authentication — internet-facing instances are directly vulnerable Patch is available — prioritize updating to the fixed version |
| Exploit ScenarioDerived | This vulnerability can be exploited remotely without authentication or user interaction, making it suitable for automated scanning and mass exploitation. An attacker can extract sensitive data from the database, modify records, or in some cases achieve command execution on the database server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
High severity vulnerability in wpDiscuz (WordPress plugin). wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.
RemediationAI
Patches available:
- https://wordpress.org/plugins/wpdiscuz/#developers
Update to the latest patched version as soon as possible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vulnerability Type: SQL Injection (CWE-89) CVSS 3.1: 8.1/10.0 — Attack Vector: Network | Complexity: High | Privileges Required: None | User Interaction: None Attack Techniques: Sqli Source: VulnCheck SQL injection allows attackers to manipulate database queries, potentially reading, modifying, or deleting data.
Know when Wpdiscuz gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.
Executive ViewAI
A high-severity SQL injection vulnerability in the wpDiscuz WordPress plugin could allow attackers to breach your WordPress database and extract sensitive customer or organizational data. Organizations using wpDiscuz versions prior to 7.6.47 face immediate risk of data compromise and should prioritize patching within 24 hours.
Apply vendor patch. If immediate patching is not possible: implement Web Application Firewall (WAF) rules to block SQL injection payloads targeting wpDiscuz subscription endpoints; disable wpDiscuz plugin temporarily; restrict database user permissions to least-privilege access; enable database query logging and anomaly detection; segment WordPress infrastructure from critical systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in wpDiscuz Multiple Security Vulnerabilities
View all 14A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute
The Comments - wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments - wpDiscuz plugin <= 7.6.11 versions. Rated hi
Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch
The Comments - wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow mess
The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could a
Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). Rated high severity (CVSS
GitHub PoC
Exploit-DB