What’s Vulnerable › Vulnerabilities
CVE-2026-87771: Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and read
- Severity: high (CVSS 8.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-18 · updated 2026-09-18
- Weakness: CWE-89
Description
The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Affected products
- Product Question and Answer: through 1.1.0
References
Get alerted when CVE-2026-87771 or the next vulnerability affects your stack