Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

WordPress Project Management Plugin SQL Injection Risk

CVE-2026-12877 · published 3 months ago
Summary

The WordPress Project Management Plugin is vulnerable to SQL injection attacks. This means attackers can potentially access or manipulate sensitive data in the plugin. Update the plugin to version 5.1.0 or later to fix this issue.

What to do
  • Update unknown project management, bug and issue tracking plugin to version 5.1.0 or later.
Affected software
VendorProductAffected versions
unknown project management, bug and issue tracking plugin < 5.1.0
Original advisory text
Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter
The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published24 Jul 2026
Updated4 Nov 2026
First seen24 Jul 2026
Sources
CVE-2026-12877 · NVD
CVE-2026-12877 · MITRE
Track software like this
Free during beta