CVE-2026-10207: PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qauserprofilecard() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wordpress/pickplugins-question-answerfrom your environment.Uninstall the vulnerable PickPlugins Question Answer plugin if it is not required.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10207?
The severity of CVE-2026-10207 is high with a scored rating of 7.5.
What type of vulnerability is CVE-2026-10207?
CVE-2026-10207 is classified as an SQL Injection vulnerability.
How do I fix CVE-2026-10207?
To fix CVE-2026-10207, update the PickPlugins Question Answer plugin to version 1.2.74 or later.
What does the CVE-2026-10207 vulnerability affect?
CVE-2026-10207 affects the PickPlugins Question Answer plugin for WordPress.
What is the impact of CVE-2026-10207 on WordPress sites?
CVE-2026-10207 can allow unauthenticated attackers to execute SQL Injection attacks, potentially compromising the database.