CVE-2026-87771 Overview
CVE-2026-87771 is an unauthenticated SQL injection vulnerability in the Product Question and Answer WordPress plugin through version 1.1.0. The plugin fails to sanitize and escape parameters before using them in SQL queries within AJAX actions exposed to unauthenticated users. Attackers can inject arbitrary SQL and extract sensitive data from the underlying WordPress database without any authentication. The flaw is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. Exploitation requires only network access to a vulnerable WordPress site running the affected plugin.
Critical Impact
Unauthenticated network-based SQL injection permits extraction of sensitive database contents, including user credentials, order data, and site configuration.
Affected Products
- Product Question and Answer WordPress plugin, all versions through 1.1.0
- WordPress sites running the plugin with AJAX endpoints reachable by unauthenticated users
- WooCommerce deployments that install the plugin for product Q&A functionality
Discovery Timeline
- 2026-09-18 - CVE-2026-87771 published to NVD
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-87771
Vulnerability Analysis
The Product Question and Answer plugin registers AJAX handlers accessible to unauthenticated visitors through the standard WordPress wp-admin/admin-ajax.php endpoint. These handlers receive request parameters and pass them directly into SQL queries without applying esc_sql(), prepared statements via $wpdb->prepare(), or type coercion. An attacker crafts HTTP POST or GET requests containing SQL metacharacters in the vulnerable parameters. The database executes the injected fragments as part of the original query. This allows UNION-based or boolean-based extraction of arbitrary rows from the wp_users, wp_usermeta, and other tables. Data at risk includes password hashes, session tokens, email addresses, and API keys stored in options.
Root Cause
The root cause is missing input sanitization in AJAX action callbacks exposed through the wp_ajax_nopriv_ hook family. Parameters received from $_POST or $_GET are concatenated into raw SQL strings sent to $wpdb->get_results() or equivalent methods. WordPress provides $wpdb->prepare() with placeholder binding to prevent this exact class of flaw, but the affected handlers do not use it.
Attack Vector
Exploitation occurs entirely over the network with no authentication and no user interaction. An attacker sends crafted requests to admin-ajax.php specifying the vulnerable plugin action and malicious parameter values. Standard SQL injection tooling such as sqlmap can automate detection and extraction against the exposed endpoint. Refer to the WPScan Vulnerability Report for technical details on the specific parameters and actions affected.
Detection Methods for CVE-2026-87771
Indicators of Compromise
- Unusual POST or GET requests to /wp-admin/admin-ajax.php containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in parameter values
- Elevated error rates or long response times from admin-ajax.php correlating with plugin action names
- Unexpected read access to wp_users or wp_options tables in database query logs
- Outbound requests from the web server following anomalous AJAX traffic, suggesting data exfiltration
Detection Strategies
- Enable WordPress database query logging and alert on queries containing multiple UNION SELECT clauses originating from plugin handlers
- Deploy Web Application Firewall (WAF) rules that inspect admin-ajax.php request bodies for SQL injection payloads
- Monitor for the presence of the vulnerable plugin at version <= 1.1.0 using asset inventory scans
Monitoring Recommendations
- Aggregate web server access logs into a central SIEM and baseline normal admin-ajax.php request patterns
- Alert on repeated 200-status responses to admin-ajax.php from a single source IP with varying parameter lengths, a pattern consistent with blind SQL injection enumeration
- Track failed authentication attempts on WordPress admin accounts following suspicious AJAX activity, which may indicate credential harvesting from extracted hashes
How to Mitigate CVE-2026-87771
Immediate Actions Required
- Identify all WordPress sites running the Product Question and Answer plugin and confirm the installed version
- Deactivate and remove the plugin on any site running version 1.1.0 or earlier until a patched release is verified
- Rotate all WordPress administrator passwords and invalidate active sessions if exploitation is suspected
- Review database audit logs for unauthorized SELECT statements against sensitive tables
Patch Information
No vendor patch information is listed in the enriched CVE data at the time of publication. Consult the WPScan Vulnerability Report for updates on fixed versions and monitor the WordPress plugin repository for a release beyond 1.1.0.
Workarounds
- Block unauthenticated access to the plugin's specific AJAX actions at the WAF or reverse proxy layer
- Restrict admin-ajax.php to authenticated sessions where feasible using IP allowlisting or authentication middleware
- Apply generic SQL injection signatures at the WAF to filter payloads targeting admin-ajax.php
- Remove the plugin entirely if the Q&A functionality is not business-critical
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.