# CVE-2026-10207: PickPlugins Question Answer SQL injection in qa_user_profile_card

Source: https://junglewise.ai/threats/cve-2026-10207-pickplugins-question-answer-sql-injection-in-qa-user-profile-card  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-10207 · Severity: high · CVSS 7.5 · Published 2026-07-28

The PickPlugins Question Answer plugin for WordPress, which adds community discussion features to websites, contains a security flaw that allows unauthorized access to the site's database. By sending a specially crafted web request, an attacker can bypass security protections to view sensitive information stored in the database, such as user details or site configuration. This could lead to a significant data breach or compromise of the website's integrity.

Vendors: [PickPlugins](https://junglewise.ai/threats/vendors/pickplugins).

## Quick answers

**Is CVE-2026-10207 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10207 being exploited in the wild.

**How severe is CVE-2026-10207?** High severity, with a CVSS score of 7.5, published 28 July 2026.

**Which products and versions are affected?** PickPlugins Question Answer up to and including 1.2.73.

**Is there a fix for CVE-2026-10207?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10207 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-10207?** Check whether you run PickPlugins Question Answer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the PickPlugins Question Answer plugin for WordPress (versions <= 1.2.73) within the qa_user_profile_card() function. The flaw stems from the 'id' GET parameter in the user profile template being processed with wp_unslash(), which strips WordPress's default magic quotes protection. The resulting unsanitized input is then directly concatenated into a SQL query without the use of prepared statements or proper escaping. An unauthenticated remote attacker can exploit this by providing malicious SQL commands via the 'id' parameter to extract sensitive data from the database. The vulnerability is tracked as CWE-89.

## Affected products

- PickPlugins PickPlugins Question Answer up to and including 1.2.73

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: advisory

## References

- [https://plugins.trac.wordpress.org/browser/question-answer/tags/1.2.73/templates/user-profile/user-profile-hook.php](https://plugins.trac.wordpress.org/browser/question-answer/tags/1.2.73/templates/user-profile/user-profile-hook.php)
- [https://plugins.trac.wordpress.org/browser/question-answer/tags/1.2.73/templates/user-profile/user-profile.php](https://plugins.trac.wordpress.org/browser/question-answer/tags/1.2.73/templates/user-profile/user-profile.php)
- [https://plugins.trac.wordpress.org/browser/question-answer/trunk/templates/user-profile/user-profile-hook.php](https://plugins.trac.wordpress.org/browser/question-answer/trunk/templates/user-profile/user-profile-hook.php)
- [https://plugins.trac.wordpress.org/browser/question-answer/trunk/templates/user-profile/user-profile.php](https://plugins.trac.wordpress.org/browser/question-answer/trunk/templates/user-profile/user-profile.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/178e2537-e900-4264-9b29-1bb5bac36f48?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/178e2537-e900-4264-9b29-1bb5bac36f48?source=cve)