Critical · 9.8 CVE-2026-52630 EUVD-2026-76701GHSA-67xf-cmc8-8q2h

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the…

Published Sep 11, 2026 · Updated Sep 14, 2026 · Assigned by mitre

Description

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php

References

https://github.com/WoltLab/WCF
https://www.woltlab.com/de/
https://www.woltlab.com/community/thread/318621-aktualisierung-woltlab-suite-6-2-5-6-1-22-6-0-26-5-5-26/