CVE-2026-12582
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Library Management System WordPress plugin before version 3.5.8 does not sanitize or escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.
Risk Assessment
The risk involves potential theft of sensitive data such as user password hashes, which could lead to account takeover and further system compromise.
Recommendation
It is recommended to immediately update the Library Management System plugin to version 3.5.8 or later, which includes necessary security fixes against SQL injection attacks.
Other vulnerabilities in Library Management System
See all- CVE-2026-56034Critical
An unauthenticated SQL Injection vulnerability exists in Library Management System versions 3.5.7 and earlier. An attacker can remotely execute arbitrary SQL queries, leading to unauthorized database access.
- CVE-2026-18666Medium
The Library Management System WordPress plugin before version 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement. This allows users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.
Original NVD description (English source)
The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.