The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | WX Subscribe 微信支付付费订阅 | unknown |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 16 Oct 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured. | |
| Title | WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-10-16T06:00:11.471Z
Reserved: 2026-09-15T08:21:50.151Z
Link: CVE-2026-91833
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-16T07:17:13.803
Modified: 2026-10-16T07:17:13.803
Link: CVE-2026-91833
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.