CVE-2026-19704

MediumCVSS 5.3

Published: 02/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

The Comments WordPress plugin before version 7.6.66 does not validate a value used to build a database query. This allows unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.

Risk Assessment

The risk is the disclosure of non-public comments, which could compromise user privacy and reveal sensitive information, but does not lead to full database takeover.

Recommendation

Update the Comments plugin to version 7.6.66 or later, which includes a fix for validating the value used in SQL queries.

Other vulnerabilities in Comments WordPress Plugin

CVE-2026-15032Medium
The Comments WordPress plugin before version 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.

Original NVD description (English source)

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS