Yo WordPress CVE-2026-87963

No special conditions - remote unauthenticated exploitation against default installations of the Yo WordPress plugin versions 1.1 through 1.3.1. The vulnerable code path reads the 'username' request parameter and uses it in a SQL query before WordPress applies its automatic request escaping, so no plugin setting, authentication, or user interaction is required to reach it. The only meaningful limiter is deployment: the target site must have this specific niche plugin installed and activated at an affected version; impact is confined to database read/confidentiality (arbitrary DB contents including admin password hashes), with no direct write or availability effect.

This is a genuinely high-priority finding, not a paper tiger. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, single-request SQL injection with no user interaction - the easiest class of web vulnerability to exploit at scale, and public exploit code exists (WPScan). The C:H/I:N/A:N impact profile is accurate: this is a confidentiality-only read primitive that dumps arbitrary database contents, and the description explicitly calls out administrator password hashes, which means account takeover is a realistic downstream outcome once hashes are cracked. Two signals are notably ABSENT from the input and should not be assumed present: no EPSS score is provided (so exploitation-probability cannot be quantified here) and there is NO CISA KEV listing, so despite public POC there is no confirmation of active in-the-wild exploitation - treat this as 'exploitable and likely to be attempted' rather than 'confirmed exploited.' One vector caveat: the vendor set S:C (scope change), which is generous for a self-contained in-application SQL injection; I assess S:U, which lowers the base score from 8.6 to ~7.5 without changing the practical urgency. The dominant risk-limiting factor is not exploit difficulty but deployment footprint - the 'Yo' plugin is niche, so this is a serious flaw in a low-prevalence product.

An unauthenticated attacker sends a single crafted HTTP request to the vulnerable Yo plugin endpoint with a malicious payload in the 'username' parameter, which is read before WordPress applies its request escaping and passed unsanitized into a SQL query. Using UNION-based or blind injection, the attacker extracts wp_users rows and reads administrator password hashes for offline cracking. Public exploit code is available via WPScan, lowering the barrier to opportunistic mass exploitation of any exposed site running versions 1.1 through 1.3.1.