CVE-2026-10207

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/question-answer/tags/1.2.73/templates/user-profile/user-profile-hook.php#L98
• https://plugins.trac.wordpress.org/browser/question-answer/tags/1.2.73/templates/user-profile/user-profile.php#L6
• https://plugins.trac.wordpress.org/browser/question-answer/trunk/templates/user-profile/user-profile-hook.php#L98
• https://plugins.trac.wordpress.org/browser/question-answer/trunk/templates/user-profile/user-profile.php#L6
• https://www.wordfence.com/threat-intel/vulnerabilities/id/178e2537-e900-4264-9b29-1bb5bac36f48?source=cve

Published

Jul 28, 2026

Last Modified

Jul 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10201A vulnerability was determined in Assimp up to 6.0.4. This v…3.3
• CVE-2026-10202A vulnerability was identified in OFCMS 1.1.3. This issue af…6.3
• CVE-2026-10203A security flaw has been discovered in OFCMS 1.1.3. Impacted…6.3
• CVE-2026-10204A weakness has been identified in OFCMS 1.1.3. The affected …6.3
• CVE-2026-10205A security vulnerability has been detected in Metasoft 美特软件 …6.3
• CVE-2026-10206A vulnerability was detected in D-Link DI-8400 up to 16.07.2…8.8
• CVE-2026-10208A flaw has been found in code-projects Online Hospital Manag…7.3
• CVE-2026-10209A vulnerability has been found in code-projects Online Hospi…6.3
• CVE-2026-1021Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-10210A vulnerability was found in AstrBotDevs AstrBot 4.23.6. Aff…6.3
• CVE-2026-10211A vulnerability was determined in AstrBotDevs AstrBot 4.23.6…6.3
• CVE-2026-10212A vulnerability was identified in AstrBotDevs AstrBot 4.24.2…6.3