CVE-2026-87963 — HIGH (8.6)

Vulnerability Description

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.

CVSS Score

8.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

References

https://wpscan.com/vulnerability/1cc5d470-7ffe-496a-9911-9b3b5c700194/

FAQ

What is CVE-2026-87963?

CVE-2026-87963 is a vulnerability with a CVSS score of 8.6 (HIGH). The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escapi...

How severe is CVE-2026-87963?

CVE-2026-87963 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-87963?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.