CVE-2026-10207: WordPress Question Answer Plugin SQLi Flaw

CVE-2026-10207 Overview

The PickPlugins Question Answer plugin for WordPress contains a SQL Injection vulnerability affecting versions up to and including 1.2.73. The flaw resides in the qa_user_profile_card() function within the user profile template. The plugin fails to properly sanitize the id GET parameter before concatenating it into a SQL query. Unauthenticated attackers can append additional SQL statements to extract sensitive data from the WordPress database. The vulnerability is tracked under [CWE-89] and carries a network-exploitable attack profile with no authentication or user interaction required.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing user credentials, session tokens, and other sensitive information.

Affected Products

PickPlugins Question Answer plugin for WordPress versions up to and including 1.2.73
WordPress installations using the vulnerable user-profile-hook.php template
Sites exposing the plugin's user profile card endpoint publicly

Discovery Timeline

2026-07-28 - CVE-2026-10207 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-10207

Vulnerability Analysis

The vulnerability exists in the qa_user_profile_card() function of the PickPlugins Question Answer plugin. When a request reaches the user profile template, the plugin reads the id GET parameter directly from user input. The code passes this value through wp_unslash(), which strips WordPress's magic quote escaping designed to neutralize special characters in SQL contexts.

After unslashing, the plugin concatenates the raw id value directly into a SQL query string. The code does not apply esc_sql(), absint(), or use $wpdb->prepare() with parameter placeholders. This produces a classic string-concatenation SQL Injection sink reachable by any unauthenticated visitor.

Attackers can use UNION-based payloads to append additional SELECT statements. Successful exploitation exposes data from the wp_users table, including usernames and password hashes, along with authentication keys stored in wp_usermeta.

Root Cause

The root cause combines two coding errors. First, wp_unslash() removes the automatic escaping WordPress applies to superglobals. Second, the resulting user-controlled string is inserted into SQL through direct concatenation instead of a parameterized query. Refer to the vulnerable code in the user-profile-hook.php template and the user-profile.php template.

Attack Vector

The attack vector is remote and network-based. An unauthenticated attacker sends a crafted HTTP GET request to the plugin's user profile endpoint with a malicious id parameter. The payload contains SQL syntax that breaks out of the intended query context and appends attacker-controlled statements. See the Wordfence Vulnerability Report for further technical details.

The vulnerability manifests through the id GET parameter being unslashed and concatenated into a SQL statement without prepared statements. Refer to the linked plugin source code for the exact vulnerable lines rather than synthetic exploit code.

Detection Methods for CVE-2026-10207

Indicators of Compromise

HTTP GET requests to the user profile endpoint containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the id parameter
URL-encoded quotes, comment sequences (--, #, /*), or hex-encoded strings in the id GET parameter
Unusual spikes in requests to the Question Answer plugin's user profile pages from single source IPs
Web server logs showing 500-level responses or delayed response times correlating with id parameter manipulation

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id GET parameter for SQL metacharacters on Question Answer plugin routes
Enable MySQL query logging and alert on queries originating from the qa_user_profile_card() code path containing suspicious tokens
Correlate HTTP access logs with database error logs to surface injection attempts
Monitor for outbound data exfiltration patterns following anomalous requests to the plugin endpoint

Monitoring Recommendations

Review WordPress access logs for historical requests matching injection signatures against the vulnerable endpoint
Track authentication anomalies including logins from unexpected geographies that may indicate stolen credentials
Alert on new administrator account creation or privilege changes in the wp_users and wp_usermeta tables
Baseline normal traffic to the plugin endpoint and alert on statistical deviations

How to Mitigate CVE-2026-10207

Immediate Actions Required

Update the PickPlugins Question Answer plugin to a version later than 1.2.73 once the vendor releases a patched release
If no fixed version is available, disable and remove the Question Answer plugin from affected WordPress sites
Rotate all WordPress administrator passwords and invalidate active sessions across affected installations
Rotate WordPress authentication salts defined in wp-config.php to force re-authentication

Patch Information

A fixed version had not been documented in the referenced advisory at time of publication. Monitor the Wordfence Vulnerability Report and the plugin repository for updates. Apply the patch across all WordPress sites hosting the plugin as soon as it becomes available.

Workarounds

Block requests to the Question Answer user profile endpoint at the WAF or reverse proxy layer until a patch is available
Add a WAF rule that rejects requests where the id GET parameter contains non-numeric characters
Restrict access to the plugin's user profile pages using IP allowlisting where feasible
Enable database user least privilege so the WordPress database account cannot read tables outside its schema

bash

# Example nginx rule to reject non-numeric id parameters on the plugin endpoint
location ~ /question-answer/ {
    if ($arg_id !~ "^[0-9]+$") {
        return 403;
    }
}