CVE-2026-52630

WoltLab WCF, the PHP framework underlying WoltLab Suite community/forum software, contains an unauthenticated SQL injection (CVSS 9.8) in versions 6.2.4 and earlier. The flaw is reachable through the updateUserOptions method in UserEditor.class.php and the update action in UserAction.class.php, letting a remote attacker send a crafted network request with no privileges and no user interaction to inject arbitrary SQL. Successful exploitation can expose, modify, or destroy database contents — including user tables with password hashes and session data — and, depending on database configuration, may enable further compromise of the host. Any deployment running WoltLab WCF 6.2.4 or earlier is affected. No public proof-of-concept is known and the CVE is not on the CISA Known Exploited Vulnerabilities catalog as of this writing.

What to do: Upgrade to the latest WoltLab release newer than 6.2.4 as soon as a vendor patch is available; the issue requires no authentication, so treat every WCF 6.2.4-and-earlier instance as exploitable. Until patched, block or restrict access to the affected user-update endpoints (UserAction/update, UserEditor/updateUserOptions) via a WAF rule or reverse-proxy rule targeting SQL injection patterns. Review database and web server logs for anomalous queries or unexpected requests to those actions, verify user-table integrity, and rotate administrative credentials and password-reset tokens if compromise is suspected.