CVE-2026-12877
Received Received - Intake

SQL Injection in WordPress Project Management Plugin

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: WPScan

Description
The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-12877
EUVD
EUVD-2026-48492

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated SQL injection flaw in the Software Issue Manager WordPress plugin versions below 5.1.0. It occurs because user input is not properly sanitized or escaped before being used in SQL queries. Attackers can exploit this by manipulating the search parameter in the plugin's front-end issue-tracker to execute arbitrary SQL commands.

Detection Guidance

Check if the Software Issue Manager WordPress plugin version is below 5.1.0. Use WPScan to detect vulnerable versions with: wpscan --url <target-url> --enumerate vp,vt. Alternatively, manually inspect the plugin files for unsanitized SQL queries in issue-tracker components.

Impact Analysis

This vulnerability allows attackers to execute arbitrary SQL commands on your WordPress database. This could lead to unauthorized data access, modification, or deletion. Attackers might extract sensitive information like user credentials, customer data, or other confidential details stored in the database.

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA. It may lead to unauthorized access or exposure of personal or protected health information, resulting in legal penalties, fines, and reputational damage. Organizations must address this flaw to maintain compliance with these regulations.

Mitigation Strategies

Update the Software Issue Manager plugin to version 5.1.0 or later immediately. If updating is not possible, disable the plugin or restrict access to the front-end issue-tracker feature until patched. Review database logs for suspicious queries or delays.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12877. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart