CVE-2026-12877 — Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter

CVE-2026-12877

Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter PUBLISHED

Description (CNA)

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

Affected (CNA)

Vendor / product	Versions
Unknown / Project Management, Bug and Issue Tracking Plugin	affected 0 before 5.1.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/e9d0ea92-1046-457b-9619-38b61848e36a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.