CVE-2026-91833

Name of the Vulnerable Software and Affected Versions WX Subscribe 微信支付付费订阅 WordPress plugin versions prior to 1.2.2

Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement. This allows unauthenticated attackers to perform SQL injection attacks on installations where the payment key has not been configured. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update the plugin to version 1.2.2 or later.