CVE-2026-12877

Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter

Critical · published July 24, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00415 · 34.7th percentile
Published
2026-07-24T06:00Z
EPSS history
Timeline
  • 24 JUL 06:00Z
    Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter
    cvelistv5