EUVD-2026-82671
GHSA-rjgv-8pq9-p3c3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Product Q&A plugin
-
DeliverySend crafted nopriv AJAX request
-
ExploitInject SQL via unsanitized parameter
-
ExecutionExtract database rows via UNION/blind SQLi
-
ImpactExfiltrate credentials and private data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Product Question and Answer WordPress plugin (versions through 1.1.0). The vulnerable code path is an AJAX action explicitly registered for unauthenticated (nopriv) users, so no login, role, or user interaction is required. The only real prerequisite is that the target WordPress site has the plugin installed and active; no non-default setting or specific deployment mode is needed. Limiting factor is the plugin's niche adoption rather than any exploitation gate. |
| Impact | Multiple signals converge on this being a genuine priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity exploitation with no authentication or user interaction, and CWE-89 SQLi with a publicly available WPScan proof-of-concept lowers the exploitation barrier substantially. Exploitation status: publicly available exploit code exists (WPScan) - this is NOT active exploitation; the CVE is absent from CISA KEV and no EPSS probability is provided, so exploitation-frequency signals are unknown rather than confirmed-widespread. The vendor CVSS of 8.6 is inflated primarily by the Scope-changed flag (S:C): a classic in-database SQL injection that reads data within the same DBMS security authority is conventionally scored S:U, which would reduce the score to ~7.5 (High). Impact is confidentiality-only (C:H/I:N/A:N) consistent with the description's 'extract sensitive data' framing - no data modification or denial of service is claimed. Net: a real, exploitable High-severity unauthenticated info-disclosure bug, but its priority is tempered by low real-world deployment footprint (niche plugin) rather than any weakness in the exploit signals themselves. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to one of the plugin's nopriv AJAX actions (admin-ajax.php), injecting SQL through an unsanitized parameter to read arbitrary rows from the WordPress database - e.g. wp_users password hashes, session tokens, or private customer Q&A data. A public WPScan proof-of-concept exists, so exploitation requires no bespoke research. Because AC:L and PR:N/UI:N apply, the attack can be automated and fired directly against any exposed site running the vulnerable plugin. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Unauthenticated SQL injection in the WordPress plugin 'Product Question and Answer' (versions through 1.1.0) lets remote attackers inject arbitrary SQL through AJAX actions that are explicitly exposed to logged-out users, enabling exfiltration of sensitive database contents such as user credential hashes and other site data. The flaw requires no authentication, no user interaction, and no non-default configuration - only that the plugin is installed and active - and publicly available exploit code exists via the WPScan proof-of-concept, so the exploitation barrier is low; there is no indication of confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), slightly below the 8.6 feed score which assumes a scope change; the practical risk driver is the confidentiality-only, full-database read impact combined with trivial remote reachability.
RemediationAI
No vendor-released patch is identified in the available intelligence data, and no fixed version is published beyond the affected range through 1.1.0, so the primary action is to deactivate and remove the 'Product Question and Answer' plugin from all WordPress installations until an updated release is published - the trade-off is loss of the site's Q&A functionality, but it is the only fully effective mitigation. If removal is operationally impossible, apply virtual patching at the WAF/reverse-proxy layer: block or tightly constrain unauthenticated POST requests to /wp-admin/admin-ajax.php carrying the plugin's question/answer AJAX action parameters, and deploy generic SQL-injection signatures for those parameters - note that coarse blocking of all nopriv admin-ajax.php traffic will break legitimate functionality in many other plugins and themes, so scope the rules to the specific actions. Monitor web and database logs for UNION/boolean-pattern payloads and anomalous SELECT volume against the WordPress database, and treat any pre-mitigation exposure as a data breach: the assessed impact is confidentiality-only (C:H/I:N/A:N), so rotate WordPress salts, administrative passwords, and any API keys or secrets stored in wp_options, and assume wp_users password hashes may have been exfiltrated. Consult the WPScan advisory at https://wpscan.com/vulnerability/d71642f0-431c-42fc-bf3f-2b7b3c4e3954/ and EUVD/NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-87771 for updates before restoring the plugin.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Product Question and Answer plugin registers WordPress AJAX handlers that are reachable without authentication - i.e., hooked via wp_ajax_nopriv_* rather than the authenticated wp_ajax_* variants - meaning any anonymous HTTP client can invoke them. Per the reported root cause (CWE-89, Improper Neutralization of Special Elements used in an SQL Command), the parameters passed into these handlers are used directly in SQL queries without sanitization or escaping and without prepared statements/parameter binding, allowing UNION- or boolean-based injection against the site's MySQL/MariaDB backend. The EUVD/CPE data records the affected component as cpe:2.3:a:unknown:product_question_and_answer:*:*:*:*:*:*:*:* with an empty vendor field, indicating the plugin is not well catalogued in CPE feeds; WPScan is the originating reporter and its advisory covers all releases up to and including 1.1.0. Because the vulnerable surface is the WordPress admin-ajax.php endpoint rather than a bespoke route, detection and virtual patching must target the AJAX action parameters themselves rather than a distinct URL path.
Know when Product Question And Answer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network SQLi (PR:N/AC:L) reading DB data gives C:H; classic in-database injection stays within one security authority so S:U (not S:C); no write or DoS so I:N/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Technical POC Analysis
Evidence caveat up front: the supplied source is the WPScan advisory only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Sites running the WordPress 'Product Question and Answer' plugin through version 1.1.0 are exposed to an unauthenticated database read vulnerability that can expose user credential hashes and other sensitive site data. Publicly available exploit code exists and no vendor-released patch identified at time of analysis, so any organization with this plugin active faces a low-effort remote attack path. Leadership should prioritize identifying and removing or isolating the plugin because credential exposure can drive account takeover, downstream fraud, and regulatory or reputational harm.
No vendor-released patch identified at time of analysis. Deactivate and remove the 'Product Question and Answer' plugin through version 1.1.0 as the primary mitigation; if removal is not feasible, use WAF or virtual patching to block unauthenticated AJAX SQL injection attempts, restrict plugin AJAX endpoints where possible, apply least-privilege database permissions, monitor for anomalous database queries and outbound data transfers, and rotate potentially exposed credentials and WordPress salts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB