Wx Subscribe
Monthly
Unauthenticated SQL injection in the WX Subscribe (微信支付付费订阅) WordPress plugin through version 1.2.1 allows remote attackers to read arbitrary database contents when the plugin's WeChat payment key has not been configured. Publicly available exploit code exists, but the EPSS score is very low (0.18%, 7th percentile) and the vulnerable code path is unreachable on installs where the payment key is set, limiting the realistic exploitable population. Our assessment rates confidentiality impact as high with no integrity or availability impact, and scope unchanged, yielding a CVSS base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Unauthenticated SQL injection in the WX Subscribe (微信支付付费订阅) WordPress plugin through version 1.2.1 allows remote attackers to read arbitrary database contents when the plugin's WeChat payment key has not been configured. Publicly available exploit code exists, but the EPSS score is very low (0.18%, 7th percentile) and the vulnerable code path is unreachable on installs where the payment key is set, limiting the realistic exploitable population. Our assessment rates confidentiality impact as high with no integrity or availability impact, and scope unchanged, yielding a CVSS base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).