CVE-2026-87771

Name of the Vulnerable Software and Affected Versions Product Question and Answer versions prior to 1.1.1

Description The Product Question and Answer WordPress plugin fails to sanitize and escape parameters used in SQL queries during AJAX actions accessible to unauthenticated users. This allows an unauthenticated attacker to execute SQL injection attacks and extract sensitive information from the database via the p id and read variables.

Recommendations Update the plugin to a version newer than 1.1.0. Restrict access to the AJAX actions utilizing the p id and read variables until the update is applied.