CVE-2026-10207

Name of the Vulnerable Software and Affected Versions PickPlugins Question Answer versions prior to 1.2.74

Description An issue exists where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive database information. This occurs due to insufficient sanitization of the id GET parameter in the user profile template. The qa user profile card() function uses wp unslash(), which removes WordPress magic quotes protection, and then directly concatenates the input into a SQL query without proper escaping or prepared statements.

Recommendations Update PickPlugins Question Answer to version 1.2.74 or later. As a temporary mitigation, restrict access to the user profile template or avoid using the id parameter until the update is applied.