CVE-2026-87963

Name of the Vulnerable Software and Affected Versions Yo WordPress plugin versions 1.1 through 1.3.1

Description An issue exists where the software fails to sanitize or parameterize the username request parameter before incorporating it into a SQL query. Because the parameter is read before WordPress applies its request escaping, unauthenticated attackers can perform SQL injection to read arbitrary database contents, including administrator password hashes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.