CVE-2026-91833: WX Subscribe 微信支付付费订阅 0 through 1.2.1

Affected technology

WX Subscribe 微信支付付费订阅 · 0 through 1.2.1
Vendor not specified by the source

Description’s affected range: through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can perform SQL injection attacks on installs where the payment key has not been configured.