wpDiscuz SQL Injection Vulnerability in getAllSubscriptions() Function

A SQL injection vulnerability has been identified in the wpDiscuz WordPress plugin, affecting versions prior to 7.6.47. The issue arises in the getAllSubscriptions() function, where string parameters are not properly escaped before being included in SQL queries. This flaw allows attackers to inject malicious SQL code through the email, activation_key, subscription_date, and imported_from parameters. Exploitation of this vulnerability could lead to manipulation of database queries and unauthorized access to sensitive information.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate database queries and potentially extract sensitive information from the database.