Description
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.
Published: 2026-07-28
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The PickPlugins Question Answer plugin for WordPress contains a bug that allows unauthenticated users to exploit the 'id' GET parameter in its user profile template. Insufficient sanitization, combined with wp_unslash() and direct concatenation into a SQL query, creates a classic SQL injection flaw per CWE‑89. An attacker can craft malicious input that is appended to the database query, enabling extraction of sensitive data such as user credentials or site configuration.

Affected Systems

This vulnerability is present in all releases of the PickPlugins Question Answer plugin up to and including version 1.2.73 on WordPress sites. No higher version information is supplied in the CVE data.

Risk and Exploitability

The CVSS score of 7.5 indicates medium to high severity, and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation in the wild. The flaw does not rely on privileged access, so unauthenticated attackers can trigger it via the public URL that accepts the 'id' parameter. The vulnerability is not listed in CISA’s KEV catalog, but its impact on data confidentiality makes it a significant risk if an active WordPress installation is running a vulnerable version.

Generated by OpenCVE AI on August 3, 2026 at 15:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade PickPlugins Question Answer to a version newer than 1.2.73 where the SQL injection issue is fixed.
  • If an upgrade cannot be performed immediately, uninstall or disable the plugin to remove the vulnerable code path from the website's execution environment.
  • Deploy a Web Application Firewall or security plugin that monitors and blocks malicious SQL injection attempts targeting the 'id' query parameter to provide a temporary defensive layer while a permanent fix is applied.

Generated by OpenCVE AI on August 3, 2026 at 15:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Pickplugins
Pickplugins pickplugins Question Answer
Wordpress
Wordpress wordpress
Vendors & Products Pickplugins
Pickplugins pickplugins Question Answer
Wordpress
Wordpress wordpress

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.
Title PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Pickplugins Pickplugins Question Answer
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-28T13:29:13.988Z

Reserved: 2026-05-31T06:56:00.402Z

Link: CVE-2026-10207

cve-icon Vulnrichment

Updated: 2026-07-28T13:29:10.412Z

cve-icon NVD

Status : Deferred

Published: 2026-07-28T10:16:46.510

Modified: 2026-07-28T16:07:15.840

Link: CVE-2026-10207

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T15:30:03Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')