CVE-2026-19704 WordPress CVE debrief

Who should care

Users of the Comments WordPress plugin, especially those with sensitive comment data, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating the plugin to version 7.6.66 or later, implementing additional monitoring and logging, and restricting access to sensitive comment data.

Technical summary

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The vulnerability has a CVSS score of 5.3 and is considered medium severity. This SQL injection vulnerability allows unauthorized access to sensitive comment data, potentially exposing comments that are awaiting moderation, marked as spam or trashed, or on private and draft posts. Users of the Comments WordPress plugin, especially those with sensitive comment data, should be aware of this vulnerability and take steps to mitigate it by reviewing and updating the plugin to version 7.6.66 or later, implementing additional monitoring and logging, and restricting access to sensitive comment data.

Defensive priority

Medium priority given the CVSS score of 5.3 and the potential for unauthorized comment disclosure.

Recommended defensive actions

• Review and update the Comments WordPress plugin to version 7.6.66 or later
• Implement additional monitoring and logging to detect potential SQL injection attempts
• Restrict access to sensitive comment data
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data. Evidence is limited to CVE and NVD details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.