CVE-2026-19704 in Comments Plugin
Summary
by MITRE • 09/02/2026
The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts.
The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in the Comments WordPress plugin prior to version 7.6.66 represents a critical SQL injection flaw stemming from insufficient input validation on parameters used to construct database queries. This security defect allows unauthenticated attackers to manipulate the structure of SQL statements executed by the application backend. Unlike more severe variants that permit arbitrary data extraction or remote code execution, this specific instance is characterized as an in-band error-based or blind SQL injection where the injected payload alters query logic rather than extracting raw table contents directly through standard union-based techniques. The core technical failure lies in the plugin's handling of user-supplied input without proper sanitization or parameterized queries, allowing malicious actors to inject syntactic elements that change how the database interprets the request conditions.
From an operational perspective, this vulnerability significantly compromises the confidentiality and integrity of comment data stored within the WordPress environment. Because the injection allows for logical manipulation of query filters, attackers can bypass access controls designed to restrict visibility based on post status or moderation state. Consequently, unauthenticated users are able to retrieve comments that should remain hidden from public view. This includes sensitive information contained in comments awaiting moderator approval, which often contain personal details before being vetted, as well as comments flagged as spam or moved to the trash bin by administrators. Furthermore, the flaw extends to content associated with private posts and draft entries, exposing data intended for restricted audiences only.
The impact of this vulnerability is primarily focused on information disclosure rather than full database compromise. The injected text functions as part of the query's grammar, effectively altering boolean conditions or logical operators within the SQL statement. This mechanism enables the attacker to read specific rows from the comments table that they would otherwise be denied access to under normal authentication and authorization protocols. While this does not result in the extraction of arbitrary data such as user passwords or system configurations directly through the injection point itself, it provides a substantial foothold for further reconnaissance. The exposed comment content may contain email addresses, personal opinions, or other personally identifiable information that can be leveraged for social engineering attacks or credential stuffing if linked to other breached datasets.
In terms of industry classification standards, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and falls under the ATT&CK technique T1059 Command Scripting via database queries when considering the broader context of web application exploitation. The lack of input validation is a classic example of insecure direct object references combined with injection flaws, highlighting the necessity for strict data type checking and prepared statements in all dynamic query constructions.
To mitigate this vulnerability, immediate action must be taken to upgrade the Comments WordPress plugin to version 7.6.66 or later, where these input validation checks have been implemented by the developers. For environments where an update is not immediately feasible, temporary mitigations should include implementing a Web Application Firewall rule set that detects and blocks common SQL injection patterns in comment-related endpoints. Additionally, administrators should review database access logs for signs of exploitation attempts and ensure that all plugins are kept up to date with security patches provided by their respective maintainers. Regular code audits focusing on input sanitization practices can also prevent similar vulnerabilities from being introduced into the application ecosystem.