medium6.8
CVE-2026-91833
The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated …
Impact
The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.
Affected products
| Product | Affected versions |
|---|---|
| WX Subscribe 微信支付付费订阅 WordPress Plugin | through 1.2.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.