VulnSocial

CVE-2026-10207Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-07-28); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-28: 1Mentions · 2026-07-31: 1Patch / Workaround · 2026-07-31: 1Technical Details · 2026-07-28: 1Technical Details · 2026-07-31: 107-2807-31
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    CVE-2026-10207 - SQLi in PickPlugins Question Answer plugin for WordPress. CVSS 7.5. Unauthenticated injection via 'id' param. No patch yet — disable or remove plugin immediately. #CVE #WordPress #infosec #developers #devsecops #devops #sysadmin #infosec #redteam #blueteam #git #github #gitlab https://www.valtersit.com/cve/CVE-2026-10207/

    Post summary

    The post announces an unauthenticated SQL injection (CVSS 7.5) in the PickPlugins Question Answer WordPress plugin, recommends disabling or removing the plugin, but offers no patch, exploit code, or evidence of active exploitation.

    0000057
    977 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-10207 SQL Injection in PickPlugins Question Answer Plugin for WordPress Up to 1.2.73 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-10207

    Post summary

    CVE-2026-10207 describes an SQL injection flaw in the PickPlugins Question Answer Plugin for WordPress, affecting versions up to 1.2.73.

    0000091
    4.1K followersView on X

Explore more

Back to dashboard