CVE-2026-19704 Overview
CVE-2026-19704 is a SQL injection vulnerability [CWE-89] affecting The Comments WordPress plugin in versions before 7.6.66. The plugin fails to validate a value used to build a database query. Unauthenticated attackers can inject SQL grammar to read comments they are not authorized to access. Disclosed content includes comments awaiting moderation, comments marked as spam or trashed, and comments attached to private and draft posts.
The injection alters query grammar rather than serving as extractable data. This limits confidentiality impact to comment content and does not permit arbitrary data extraction from the wider database.
Critical Impact
Unauthenticated attackers can read non-public WordPress comments, including moderation queues, spam, trash, and comments on private or draft posts.
Affected Products
- The Comments WordPress plugin versions prior to 7.6.66
- WordPress sites running the vulnerable plugin with public comment endpoints exposed
- Any hosting environment where the plugin serves unauthenticated requests
Discovery Timeline
- 2026-09-02 - CVE-2026-19704 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-19704
Vulnerability Analysis
The vulnerability resides in the request handling path of The Comments plugin. A user-controlled parameter flows into a database query without validation or parameterization. Attacker-supplied input is interpreted as SQL grammar rather than as a bound value.
The practical effect is a filter or clause manipulation attack. Instead of extracting arbitrary tables through techniques such as UNION SELECT, attackers alter the predicate that limits which comments the query returns. This causes the plugin to return comment rows the caller should not receive.
Exploitation requires no authentication. The vulnerable endpoint is reachable over the network with low complexity and no user interaction. Because the injected content becomes part of query grammar rather than extractable data, the confidentiality boundary is comment records rather than the full database.
Root Cause
The root cause is missing input validation on a value used to construct a SQL query [CWE-89]. The plugin builds the query string with the untrusted value in a way that permits SQL grammar to break out of its intended context. Parameterized queries or strict allowlist validation were not applied to the affected parameter.
Attack Vector
An unauthenticated remote attacker sends a crafted HTTP request to the plugin endpoint that consumes the vulnerable parameter. The attacker injects SQL fragments that modify the comment selection logic. The server returns comment records that would otherwise be hidden from anonymous callers, including moderation, spam, trash, private post, and draft post comments. Refer to the WPScan Vulnerability Report for the technical write-up.
Detection Methods for CVE-2026-19704
Indicators of Compromise
- HTTP requests to The Comments plugin endpoints containing SQL metacharacters such as single quotes, --, /*, UNION, or OR 1=1
- Anomalous response sizes from comment listing endpoints that suggest disclosure of non-public comment rows
- Access log entries showing repeated parameter fuzzing against plugin routes from a single source IP
- Web server logs showing wp-json or plugin-specific query parameters carrying non-numeric SQL grammar
Detection Strategies
- Inspect WordPress access logs for query strings targeting The Comments plugin with SQL syntax in parameters expected to be numeric or identifier values
- Deploy a web application firewall rule that flags SQL keywords appearing in comment query parameters from unauthenticated sessions
- Correlate database query logs with HTTP request logs to identify malformed WHERE clauses touching the wp_comments table
Monitoring Recommendations
- Enable WordPress and plugin audit logging to capture unauthenticated access to comment endpoints
- Alert on outbound responses containing comment content flagged as spam, trash, or attached to private or draft post statuses
- Track version inventory for The Comments plugin across all managed WordPress sites and flag any installation below 7.6.66
How to Mitigate CVE-2026-19704
Immediate Actions Required
- Upgrade The Comments WordPress plugin to version 7.6.66 or later on all affected sites
- Audit comment moderation queues and private post comments for evidence of prior unauthorized disclosure
- Restrict access to plugin endpoints with a web application firewall until patching completes
Patch Information
The vendor addressed the flaw in The Comments plugin version 7.6.66. The fix validates the affected parameter before it is used in the database query. Administrators should apply the update through the WordPress plugin manager or by deploying the patched release from the official plugin repository. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily deactivate The Comments plugin on affected WordPress installations until the update is applied
- Configure a web application firewall rule that blocks SQL metacharacters on the affected plugin parameters
- Restrict comment endpoint access to authenticated sessions where the deployment permits it
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
