What is the CVSS score of CVE-2026-10207?

CVE-2026-10207 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

PickPlugins Question Answer CVE-2026-10207

EUVD-2026-49734 HIGH

SQL Injection (CWE-89)

2026-07-28 security@wordfence.com

GHSA-2mj4-7p84-mjc9

SQLi WordPress

7.5

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote attacker can exploit via GET request, no user interaction, only confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 10:30 vuln.today

CVE Published

Jul 28, 2026 - 10:16 nvd

HIGH 7.5

DescriptionCVE.org

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.

Articles & Coverage 1

News 19 New WordPress Vulnerabilities - 2 Critical, 17 High Jul 29, 2026

AnalysisAI

SQL injection in PickPlugins Question Answer for WordPress up to 1.2.73 permits unauthenticated remote attackers to extract sensitive database information via the unsanitized 'id' GET parameter. The vulnerability is automatable, requires no user interaction, and exposes confidential data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Access public-facing WordPress site with plugin enabled

Exploit

Craft HTTP GET request with malicious id parameter

Execution

wp_unslash() strips WordPress escaping, input concatenated directly into SQL

Impact

Extract sensitive database information.

Access

Access public-facing WordPress site with plugin enabled

Exploit

Craft HTTP GET request with malicious id parameter

Execution

wp_unslash() strips WordPress escaping, input concatenated directly into SQL

Impact

Extract sensitive database information.

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against default configurations of PickPlugins Question Answer plugin. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high-severity information disclosure with low attack complexity and no privileges or user interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker identifies a WordPress site with the vulnerable plugin active. They send a crafted GET request to a user profile page (e.g., /user-profile/?user=1&id=...), injecting SQL payloads via the id parameter. …
Remediation	Update the PickPlugins Question Answer plugin to a patched version beyond 1.2.73 once released. … Detailed patch versions, workarounds, and compensating controls in full report.