Overview
A critical unauthenticated SQL injection vulnerability has been disclosed in the Project Management, Bug and Issue Tracking Plugin for WordPress, tracked as CVE-2026-12877. The flaw carries a CVSS v3.1 base score of 9.1 (Critical) and enables remote attackers to read and manipulate database contents without requiring any login, user interaction, or special conditions.
All versions of the plugin prior to 5.1.0 are affected. Site administrators should update immediately.
Technical Details
The vulnerability exists because the plugin fails to sanitize or escape user-supplied input before incorporating it into SQL queries. This is a textbook SQL injection pattern (CWE-89), and in this case it is reachable by completely unauthenticated HTTP requests.
The CVSS attack vector breakdown tells the full story of severity:
| Metric | Value |
|---|---|
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | None |
No authentication, no complex setup, no victim click required — any attacker with network access to the WordPress site can trigger it. The high confidentiality and integrity impacts mean data can be both read and modified.
Why This Matters
Project management and issue tracking plugins hold particularly sensitive business data: bug reports, feature roadmaps, team assignments, internal project documentation, and potentially credentials embedded in tickets. A successful SQL injection against one of these plugins can expose an entire organization's operational context to an attacker.
The low complexity and unauthenticated nature of this vulnerability make it trivially automatable. Opportunistic threat actors running mass-scanning tools can identify and exploit vulnerable WordPress installations at scale within hours of a public CVE disclosure. A functional proof-of-concept already exists.
Affected Versions
- All versions before 5.1.0 of the Project Management, Bug and Issue Tracking Plugin for WordPress.
Mitigation
- Update the plugin to version 5.1.0 or later — this is the only complete fix.
- If an immediate update is not possible, consider temporarily deactivating the plugin until patching is feasible.
- After patching, audit your WordPress database for unexpected rows or modifications in plugin-managed tables to detect any prior exploitation.
- Ensure your WordPress installation and all other plugins are also kept up to date.
- Web application firewall (WAF) rules can provide partial protection but should not be treated as a permanent substitute for patching.