CVE-2026-22193Disclosure(gvectors / wpdiscuz)

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.

gvectors CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.vulncheck.com/advisories/wpdiscuz-before-sql-injection-in-getallsubscriptions

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

wpdiscuz

Threat summary

Public PoC is present in monitored signal
5 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 4 signals
Disclosure: 5 classified signals
Peaked 1d ago at 4 mentions (2026-03-13); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

gvectors

Products

wpdiscuz

Deep dive

Activity timeline5 mentions / 2d

Signal classification1 categories

Disclosure

5100.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-13	4	Disclosure4
2026-03-14	1	Disclosure1

Full discourse5 posts

RedPacket Security@RedPacketSec210d
Disclosure
CVE Alert: CVE-2026-22193 - gVectors - wpDiscuz - https://www.redpacketsecurity.com/cve-alert-cve-2026-22193-gvectors-wpdiscuz/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-22193 #gvectors #wpdiscuz
Post summary
A CVE alert for CVE-2026-22193 affecting the gVectors wpDiscuz plugin is posted by RedPacketSecurity; no PoC, exploit, or remediation details are included.
0000099
3.6K followersView on X
The Hacker Wire@TheHackerWire210d
Disclosure
🟠 CVE-2026-22193 - High wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject ma... https://www.thehackerwire.com/vulnerability/CVE-2026-22193/ https://t.co/mRYfDlf7Yb
Post summary
The post announces a high‑severity SQL injection vulnerability in wpDiscuz versions before 7.6.47, detailing the affected function and potential for attacker injection.
0000031
135 followersView on X
CVE@CVEnew211d
Disclosure
CVE-2026-22193 wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries… https://www.cve.org/CVERecord?id=CVE-2026-22193
Post summary
The post announces CVE-2026-22193, detailing an SQL injection flaw in wpDiscuz's getAllSubscriptions() due to missing quote escaping.
00000118
56.7K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash211d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-22193 - wpDiscuz SQL Injection Vulnerability Intel Report: https://ift.tt/wbsgveD
Post summary
The alert announces CVE-2026-22193, a SQL injection flaw in wpDiscuz, and provides a link to an Intel Report; no exploitation or mitigation details are included.
0000037
340 followersView on X
0day Signal@0dayPublishing211d
Disclosure
🚨 CVE-2026-22193: wpDiscuz before 7.6.47 - SQL Inj... Four unescaped parameters in getAllSubscriptions() = instant database compromise for 100K+ WordPress sites running wpDi... https://zerodaysignal.com/vulnerability/CVE-2026-22193 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE-2026-22193 affecting wpDiscuz, highlighting four unescaped parameters that enable database compromise, and links to a vulnerability page, but provides no PoC or exploit code.
0000072
144 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	gvectors	wpdiscuz	-	wordpress	-

Explore more

Back to dashboard gvectors CVEs wpdiscuz vulnerabilities

What researchers are saying

CVE-2026-22193

RedPacket Security@RedPacketSecDisclosure

A CVE alert for CVE-2026-22193 affecting the gVectors wpDiscuz plugin is posted by RedPacketSecurity; no PoC, exploit, or remediation details are included.

The Hacker Wire@TheHackerWireDisclosure

The post announces a high‑severity SQL injection vulnerability in wpDiscuz versions before 7.6.47, detailing the affected function and potential for attacker injection.

CVE@CVEnewDisclosure

The post announces CVE-2026-22193, detailing an SQL injection flaw in wpDiscuz's getAllSubscriptions() due to missing quote escaping.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The alert announces CVE-2026-22193, a SQL injection flaw in wpDiscuz, and provides a link to an Intel Report; no exploitation or mitigation details are included.

0day Signal@0dayPublishingDisclosure

The tweet announces CVE-2026-22193 affecting wpDiscuz, highlighting four unescaped parameters that enable database compromise, and links to a vulnerability page, but provides no PoC or exploit code.