Description

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T06:17:16.937Z",
  "pubdate": "2026-09-02T06:17:16.937Z",
  "executiveSummary": "The Comments WordPress plugin, in versions prior to 7.6.66, contains an unauthenticated SQL injection vulnerability due to improper input validation.\nThis flaw allows unauthenticated remote attackers to manipulate database queries to retrieve unauthorized comment content.\nThe impact is limited to the unauthorized disclosure of protected comment data, including those awaiting moderation, marked as spam, trashed, or associated with private and draft posts.\nThe vulnerability occurs because user-supplied input is improperly concatenated into database queries, allowing the input to be interpreted as SQL grammar rather than literal data.\nWhile the exploitation does not allow for full database extraction or arbitrary data exfiltration, it facilitates unauthorized access to sensitive information typically restricted by WordPress access control policies.\nThere are no specific privileges required for exploitation, as the vector is accessible to unauthenticated users over the network.",
  "technicalDetails": "The root cause of the vulnerability is an insecure implementation of database query construction within the Comments WordPress plugin. Specifically, the application fails to sanitize or parameterize user-supplied input before incorporating it into an SQL query string.\nBecause the input is treated as SQL grammar, the application is susceptible to SQL injection. An attacker can craft a payload designed to alter the logic of the query—for instance, by manipulating 'WHERE' clauses or 'JOIN' conditions—to bypass existing access control checks that would normally restrict the visibility of specific comments.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies a request parameter processed by the vulnerable component. By injecting malicious SQL syntax into this parameter, the attacker alters the resulting query executed by the database. Since the database engine interprets the injected syntax as instructions, the query returns a result set that includes unauthorized records.\nImpact analysis indicates that this vulnerability allows for the unauthorized retrieval of comments in sensitive states (pending moderation, spam, or trashed) and comments attached to non-public content (drafts or private posts).\nIt is important to note that the scope of this vulnerability is confined to the content of the comment table entries. The injection does not allow for arbitrary command execution, database schema modification, or full exfiltration of the entire database, as the injected text is strictly interpreted within the context of the specific query structure. Despite this constraint, the confidentiality impact is significant due to the exposure of data that violates WordPress privacy and moderation workflows."
}