Executive brief
WoltLab WCF is a community framework used to power discussion forums and websites. An authenticated SQL injection vulnerability allows logged-in users to extract arbitrary data from the database, potentially leading to unauthorized access to privileged accounts—particularly those without two-factor authentication protection. This could enable account takeover and administrative compromise.
Technical details
An authenticated SQL injection vulnerability exists in UserEditor.class.php and the update action in UserAction.class.php in WoltLab WCF version 6.2.4 and earlier. The flaw arises from insufficient input validation when processing user options, allowing authenticated attackers to craft malicious SQL queries and read sensitive data from the database. The vulnerability requires valid user credentials but does not require administrator privileges or user interaction. Attackers can leverage this to enumerate and extract privileged user account information, create new administrative users, or modify permissions. Patches are available in WoltLab Suite 6.2.5, 6.1.22, 6.0.26, and 5.5.26.
Affected products
- WoltLab WCF 6.2.4 and earlier
Timeline
- 2026-09-11: disclosed: CVE-2026-52630 published on NVD
- 2026-06-15: advisory: Security update released for WoltLab Suite 6.2.5, 6.1.22, 6.0.26, 6.5.26
- 2026-06-15: patched: Patches available in WoltLab Suite versions 5.5.26 and later across all branches