MajorCritical vulnerability

CVE-2026-87963 (CVSS 8.6)

NVD · officialPublished Sep 17, 2026Risk 37/100EPSS 0.3%

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.

Technical details

CVSS

8.6

AV:NetworkAC:LowPR:NoneUI:NoneC:HighI:NoneA:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source