CVE-2026-87771 - Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and read

Back Back to CVE browser

HIGH

Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and read

Published Sep 18, 2026

8.6

HIGH

CVSS 3.1

EPSS 0.45%

Description

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.

Affected products

Vendor n/a Product Product Question and Answer Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=1.1.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Product Question and Answer

n/a

Version	Status	Constraints
0	affected	<=1.1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (1)

https://wpscan.com/vulnerability/d71642f0-431c-42fc-bf3f-2b7b3c4e3954/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://wpscan.com/vulnerability/d71642f0-431c-42fc-bf3f-2b7b3c4e3954/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Sep 18, 2026

Updated Sep 18, 2026

Reserved Sep 9, 2026

Link CVE-2026-87771

CISA Vulnrichment

Updated Sep 18, 2026

NVD

Status Deferred

Modified Sep 18, 2026

Link CVE-2026-87771

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-87771