CVE-2026-12877: Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter
The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Project Management, Bug and Issue Tracking Pluginto a version that resolves this vulnerability.Fixed in 5.1.0 - Configuration
Ensure the plugin version at least 5.1.0 is deployed for the standard front-end issue-tracker configuration so user supplied input used in SQL queries is sanitised and escaped (fixes unauthenticated SQL injection via the search parameter).
Project Management, Bug and Issue Tracking Plugin (WordPress) standard front-end issue-tracker configuration = apply patched version validation/sanitisation for search parameter before SQL query
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12877?
CVE-2026-12877 has a severity score of 80, indicating a significant security risk.
How do I fix CVE-2026-12877?
To fix CVE-2026-12877, update the Project Management, Bug and Issue Tracking Plugin to version 5.1.0 or later.
What type of vulnerability is CVE-2026-12877?
CVE-2026-12877 is classified as an unauthenticated SQL injection vulnerability.
Who is affected by CVE-2026-12877?
Any user of the Project Management, Bug and Issue Tracking Plugin for WordPress below version 5.1.0 is affected by CVE-2026-12877.
What attacker capabilities does CVE-2026-12877 allow?
CVE-2026-12877 allows unauthenticated attackers to perform SQL injection attacks, potentially compromising the database.