CVE-2026-87963 is a SQL injection vulnerability in the Yo WordPress plugin versions 1.1 through 1.3.1. The plugin fails to sanitize or parameterize the username request parameter before using it in a SQL query and reads it prior to WordPress applying request escaping. This allows unauthenticated attackers to inject SQL commands and read arbitrary database contents, including sensitive data such as administrator password hashes. The vulnerability has a CVSS v3.1 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a confidentiality impact of high.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks against the Yo plugin's database queries. This can lead to unauthorized disclosure of sensitive information, including administrator password hashes, which could facilitate further compromise of the WordPress site. The integrity and availability impacts are not indicated, but confidentiality is severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Yo plugin or restricting access to vulnerable endpoints to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.