Vulnerability · Published Jul 24, 2026 · Assigned by WPScan

CVE-2026-12877Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter

Critical 9.1

In plain English

A critical-severity improper authentication in Project Management, Bug and Issue Tracking Plugin from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Project Management, Bug and Issue Tracking Plugin	0 – before 5.1.0

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://wpscan.com/vulnerability/e9d0ea92-1046-457b-9619-38b61848e36a/ exploit, vdb-entry, technical-description