CVE-2026-12877

CRITICAL

Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-12877. PoCs published by incogbyte.

AI-analyzed exploit summary This repository contains a functional time-based blind SQL injection exploit for CVE-2026-12877, targeting the WordPress plugin 'Software Issue Manager' <= 5.0.1. The exploit leverages unauthenticated search parameter injection to execute arbitrary SQL via a crafted LIKE clause, demonstrating the vulnerability with a delay-based proof-of-concept.

Description

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

Exploits (1)

github WORKING POC 5 stars

by incogbyte · pythonpoc

https://github.com/incogbyte/wp-cve-exploits/tree/main/CVE-2026-12877

View Code ZIP pw:eip

This repository contains a functional time-based blind SQL injection exploit for CVE-2026-12877, targeting the WordPress plugin 'Software Issue Manager' <= 5.0.1. The exploit leverages unauthenticated search parameter injection to execute arbitrary SQL via a crafted LIKE clause, demonstrating the vulnerability with a delay-based proof-of-concept.

Classification

Working Poc 99%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: Software Issue Manager (WordPress Plugin) <= 5.0.1

No auth needed

Prerequisites: Target must have at least one 'emd_issue' or 'emd_project' entity visible to anonymous visitors (default settings allow this) · Plugin version <= 5.0.1

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

mistral-large-3 · analyzed Jul 30, 2026 Full analysis →

References (1)

Core 1

Core References

Exploit exploit vdb-entry technical-description

https://wpscan.com/vulnerability/e9d0ea92-1046-457b-9619-38b61848e36a/

Scores

CVSS v3 9.1

EPSS 0.0024

EPSS Percentile 15.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-287

Status published

Products (1)

None/Project Management, Bug and Issue Tracking Plugin < 5.1.0

Published Jul 24, 2026

Tracked Since Jul 24, 2026