Is CVE-2026-91833 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-91833

Description

The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.