PickPlugins Question Answer exposes unauthenticated SQL injection through user profiles
PickPlugins Question Answer through 1.2.73 accepts an unauthenticated id GET parameter in its user-profile template. The value passes through wp_unslash() and is concatenated directly into a database query by qa_user_profile_card() without escaping or a prepared statement, allowing an attacker to append SQL and extract sensitive database information. The CNA record does not disclose the public page or route that renders the profile template or the exact query. No fixed public release is identified, and the WordPress.org plugin entry and cited source are no longer publicly available.
- Component
- PickPlugins Question Answer
- Plugin slug
question-answer- Affected
- <= 1.2.73
- Safe version
- See mitigation notes
- Published
- Jul 28, 2026
This CVE was published Jul 28, 2026 and is one of 4 known issues for this plugin.
Update, patch or deactivate.
No fixed public release is currently available. Deactivate and replace PickPlugins Question Answer. Any private patch should validate the id as the expected identifier type and pass it through a prepared query.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N