CVE-2026-12877

CriticalCVSS 9.1

Published: 24/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before version 5.1.0 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the standard front-end issue tracker configuration.

Risk Assessment

An unauthenticated attacker can execute arbitrary SQL queries, potentially leading to data leakage, database modification, or privilege escalation.

Recommendation

Update the Project Management, Bug and Issue Tracking Plugin to version 5.1.0 or later.

Original NVD description (English source)

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.