CVE-2026-87771 in Product Question and Answer Plugin
Summary
by MITRE • 09/18/2026
The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Product Question and Answer WordPress plugin through version 1.1.0 represents a critical security flaw rooted in insufficient input validation and output encoding mechanisms. Specifically, the application fails to properly sanitize or escape user-supplied parameters before incorporating them into SQL queries executed via AJAX endpoints that are accessible without authentication. This architectural oversight allows unauthenticated attackers to inject malicious SQL code directly into database operations, bypassing standard access controls entirely. The core technical failure lies in the lack of prepared statements or rigorous type checking for inputs received through HTTP POST requests associated with plugin-specific AJAX actions. By treating user input as executable code rather than data, the application creates a direct pathway for attackers to manipulate backend database logic.
From an operational perspective, this vulnerability enables severe consequences including full database compromise. An attacker can exploit this flaw to extract sensitive information such as administrator usernames and password hashes, customer personal data, or proprietary business records stored within the WordPress installation. The ability to perform arbitrary SQL queries also opens the door for more advanced attacks, such as modifying existing records, deleting critical tables, or potentially achieving remote code execution depending on the database configuration and server environment. Because the affected AJAX actions are unauthenticated, the attack surface is significantly expanded, allowing any internet user with basic knowledge of SQL injection techniques to target the vulnerable endpoints without needing valid credentials or prior interaction with the site beyond making a simple HTTP request.
This vulnerability aligns closely with CWE-89 Improper Neutralization of Special Elements used in an SQL Command commonly known as SQL Injection. The specific vector involves unauthenticated access, which exacerbates the risk profile by removing any barrier to entry for potential exploiters. In terms of threat modeling and adversary behavior, this activity corresponds to ATT&CK technique T1059 Command and Scripting Interpreter if script-based injection is used, or more broadly under data exfiltration techniques where structured query language commands are crafted to retrieve specific datasets from the backend storage system. The lack of authentication requirement places it in a high-severity category within vulnerability management frameworks due to its ease of exploitation and potential for widespread impact across WordPress ecosystems that rely on this plugin.
Mitigation strategies must prioritize immediate remediation through software updates or code-level fixes if an update is not yet available from the vendor. Administrators should upgrade to version 1.1.1 or later where these sanitization issues have been addressed by implementing proper parameterized queries using prepared statements, which separate SQL logic from data inputs effectively preventing injection attempts. In cases where immediate patching is not feasible, temporary mitigations include restricting access to the specific AJAX endpoints via web application firewall rules that block suspicious query patterns associated with SQL injection payloads. Additionally, enforcing strict input validation on all user-supplied fields and ensuring consistent use of escaping functions like wpdb prepare in WordPress development practices are essential long-term defensive measures against this class of vulnerabilities. Regular security audits and code reviews focusing on database interaction layers can further reduce the risk of similar flaws emerging in future plugin versions or custom integrations.