WordPress Plugin Vulnerabilities

Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

Description

The plugin does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.

Proof of Concept

Affects Plugins

Plugin icon
yo
No known fix

References

CVE
CVE-2026-87963

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
1cc5d470-7ffe-496a-9911-9b3b5c700194

Timeline

Publicly Published
2026-09-15 (about 2 days ago)
Added
2026-09-15 (about 1 day ago)
Last Updated
2026-09-15 (about 1 day ago)

Other

Published
Title
Published
2026-07-02
Title
Advanced Shipment Tracking for WooCommerce < 4.0.1 - Authenticated (Shop manager+) SQL Injection
Published
2024-09-16
Title
WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection
Published
2024-11-01
Title
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress < 1.1.17 - Authenticated (Subscriber+) SQL Injection
Published
2026-08-10
Title
WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter
Published
2025-01-03
Title
Fancy Product Designer < 6.4.4 - Unauthenticated SQL Injection