CVE-2026-87963

Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.

Affected

Yo

CVSS v3.1 WPSCAN

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

0.45% chance of exploitation in the next 30 days, 37th percentile

Published

2026-09-17

Updated

2026-09-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1cc5d470-7ffe-496a-9911-9b3b5c700194/

References

• CVE Record
• NVD entry