Executive brief
The Product Question and Answer WordPress plugin is used to add customer review and question functionality to e-commerce sites. The plugin fails to properly validate user input in AJAX endpoints, allowing attackers without any authentication to inject malicious SQL code and extract sensitive customer data from the website's database, including personal information and transaction history.
Technical details
The vulnerability is a SQL injection (SQLi) flaw in AJAX actions exposed to unauthenticated users. The plugin accepts parameters (p_id and read) in AJAX requests but does not sanitize or escape them before including them in SQL queries. An attacker can craft a malicious HTTP request with SQL metacharacters in these parameters to break out of the intended query and execute arbitrary SQL commands. No authentication is required, making this exploitable by any remote attacker. The attack allows extraction of sensitive data from the WordPress database. As of the advisory date, no patch has been released.
Affected products
- WordPress Product Question and Answer through 1.1.0
Timeline
- 2026-09-16: disclosed
- 2026-09-18: advisory