CVE-2026-91833: WX Subscribe WordPress Plugin SQLI Vulnerability

CVE-2026-91833 Overview

CVE-2026-91833 is an unauthenticated SQL injection vulnerability affecting the WX Subscribe (微信支付付费订阅) WordPress plugin through version 1.2.1. The plugin fails to sanitize and escape a user-supplied parameter before passing it into a SQL statement. Attackers can inject arbitrary SQL on installations where the WeChat payment key has not been configured. The flaw is tracked under CWE-89 and allows exploitation over the network without authentication. The condition requirement (unconfigured payment key) raises the attack complexity but does not eliminate real-world exposure.

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including WordPress user records and session data, through crafted SQL payloads.

Affected Products

WX Subscribe (微信支付付费订阅) WordPress plugin, versions through 1.2.1
WordPress installations where the plugin is active with an unconfigured payment key
Any site exposing the vulnerable plugin endpoint to the internet

Discovery Timeline

2026-10-16 - CVE-2026-91833 published to the National Vulnerability Database
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-91833

Vulnerability Analysis

The WX Subscribe plugin provides WeChat Pay-based subscription functionality for WordPress sites. The vulnerable code path accepts a request parameter and concatenates it into a SQL query without parameterization or escaping. Because the vulnerable branch executes before any authentication check, remote attackers can reach it without valid credentials.

The exploitation condition requires the site owner to have left the WeChat payment key unconfigured. This is a common state for freshly installed plugins or trial deployments. Attackers can enumerate vulnerable targets by probing the plugin's public endpoints.

Successful injection enables data exfiltration from the WordPress database, including the wp_users table containing hashed passwords and the wp_options table containing site secrets.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command (CWE-89). The plugin passes attacker-controlled input directly into $wpdb->query() or an equivalent call without using $wpdb->prepare() or the esc_sql() sanitization helper provided by the WordPress API.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP request to the plugin's vulnerable endpoint with SQL metacharacters in the targeted parameter. The injected clause executes within the WordPress database context. Full technical details are available in the WPScan Vulnerability Report.

No verified public exploit code is published at this time. Attackers familiar with standard SQL injection techniques against WordPress plugins can reproduce the condition using union-based or time-based payloads.

Detection Methods for CVE-2026-91833

Indicators of Compromise

HTTP requests to WX Subscribe plugin endpoints containing SQL metacharacters such as UNION SELECT, SLEEP(, OR 1=1, or inline comment sequences (/*, --)
Database errors or unusually slow responses from the WordPress MySQL backend correlating with plugin request logs
Unexpected read access to the wp_users or wp_options tables outside normal administrative workflows

Detection Strategies

Enable WordPress and web server access logging and inspect requests targeting /wp-content/plugins/ paths associated with the WX Subscribe plugin
Deploy web application firewall (WAF) rules that identify SQL injection signatures in query strings and POST bodies to the plugin
Enable MySQL general query log or audit plugin to capture anomalous queries referencing WordPress core tables

Monitoring Recommendations

Alert on repeated 500-series responses from plugin endpoints that suggest SQL parsing errors
Monitor outbound data volume from the WordPress host for signs of bulk data exfiltration
Track installations of the WX Subscribe plugin across managed sites and flag any instance with an unconfigured payment key

How to Mitigate CVE-2026-91833

Immediate Actions Required

Deactivate and uninstall the WX Subscribe plugin until a fixed version is released by the vendor
If the plugin must remain active, complete the WeChat payment key configuration to close the vulnerable code path
Restrict access to the WordPress site at the network edge using a WAF with SQL injection protection enabled

Patch Information

At the time of publication, no fixed version is referenced in the WPScan Vulnerability Report. All versions through 1.2.1 are affected. Monitor the WordPress plugin repository and WPScan for an upstream patch and apply it immediately upon release.

Workarounds

Configure the WeChat payment key within the plugin settings to bypass the vulnerable code branch
Block public access to the plugin's PHP endpoints at the web server or reverse proxy level
Apply a virtual patch via WAF rules that reject requests containing SQL metacharacters in the vulnerable parameter

bash

# Example nginx rule to block plugin access until patched
location ~* /wp-content/plugins/wx-subscribe/ {
    deny all;
    return 403;
}