CVE-2026-10207
Received Received - Intake

SQL Injection in PickPlugins Question Answer WordPress Plugin

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-10207
EUVD
EUVD-2026-49734

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pickplugins question_answer to 1.2.73 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL Injection flaw in the PickPlugins Question Answer WordPress plugin. It allows unauthenticated attackers to inject malicious SQL queries through the 'id' parameter in the user profile template. The issue occurs because user input is not properly sanitized before being used in a SQL query, combined with WordPress's wp_unslash() function which removes protective measures.

Detection Guidance

To detect this vulnerability, inspect WordPress sites running the PickPlugins Question Answer plugin versions up to and including 1.2.73. Check for suspicious SQL queries in logs or network traffic involving the 'id' GET parameter in user profile templates. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to extract sensitive data from the WordPress database, such as user credentials, personal information, or other confidential data. Since it requires no authentication, any website using the vulnerable plugin version is at risk of data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements. For HIPAA, it may expose protected health information, risking compliance with security and privacy rules. Organizations could face fines or legal penalties for failing to protect sensitive data.

Mitigation Strategies

Immediately update the PickPlugins Question Answer plugin to the latest version beyond 1.2.73. If an update is unavailable, consider disabling the plugin temporarily. Review database access logs for signs of exploitation and ensure WordPress core, themes, and other plugins are updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart