CVE-2026-19704

Name of the Vulnerable Software and Affected Versions Comments WordPress plugin versions prior to 7.6.66

Description An issue exists where the software fails to validate a value used to construct a database query. This allows unauthenticated users to perform SQL injection, enabling them to read comments they are not authorized to access, such as those awaiting moderation, marked as spam, trashed, or associated with private and draft posts. The injected text is processed as grammar rather than data, limiting the impact to the disclosure of comment content rather than the entire database.

Recommendations Update Comments WordPress plugin to version 7.6.66 or later.