CVE-2026-12877: WordPress Project Management Plugin SQLi

CVE-2026-12877 Overview

CVE-2026-12877 is an unauthenticated SQL injection vulnerability in the Project Management, Bug and Issue Tracking WordPress plugin before version 5.1.0. The plugin fails to sanitize and escape user-supplied input before using it in SQL queries. Attackers can inject arbitrary SQL statements through the plugin's standard front-end issue-tracker configuration without authentication. The flaw is categorized under [CWE-287] and affects installations that expose the issue-tracker interface to unauthenticated users. Successful exploitation allows attackers to read sensitive database contents and modify data stored by WordPress and the plugin itself.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the WordPress database, exposing user credentials, session tokens, and confidential project data.

Affected Products

Project Management, Bug and Issue Tracking WordPress Plugin versions prior to 5.1.0
WordPress installations exposing the plugin's front-end issue-tracker interface
Sites running the plugin in its standard, unmodified front-end configuration

Discovery Timeline

2026-07-24 - CVE-2026-12877 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-12877

Vulnerability Analysis

The vulnerability resides in the plugin's front-end issue-tracker request handling. User-controlled parameters flow into SQL query construction without parameterization or escaping. An unauthenticated attacker submits crafted input through the exposed front-end form or endpoint. The plugin concatenates that input directly into a SQL statement executed against the WordPress database.

Because exploitation requires no authentication and no user interaction, the attack surface extends to any internet-reachable WordPress site running an affected plugin version. The plugin's issue-tracker feature is commonly exposed to anonymous submitters, making the standard configuration inherently vulnerable. Attackers can enumerate database schemas, exfiltrate the wp_users table including password hashes, and read arbitrary rows.

EPSS data places the current exploitation probability in the lower percentile range, but public advisory details on WPScan simplify reproduction. See the WPScan Vulnerability Detail for reference material.

Root Cause

The root cause is missing input sanitization and the absence of prepared statements. The plugin passes attacker-controlled values into SQL queries without using WordPress's $wpdb->prepare() interface or escaping helpers such as esc_sql(). Any query parameter reachable from the front-end handler becomes an injection point.

Attack Vector

Attackers deliver the payload over the network as HTTP requests to the plugin's front-end issue-tracker endpoint. No credentials, tokens, or user interaction are required. Payloads use standard SQL injection techniques such as UNION-based extraction, boolean-based blind injection, and time-based blind injection against MySQL or MariaDB backends. See the WPScan Vulnerability Detail for technical specifics.

Detection Methods for CVE-2026-12877

Indicators of Compromise

Anomalous HTTP POST or GET requests to the plugin's issue-tracker endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or encoded variants
Unexpected outbound queries or long-running database sessions originating from the WordPress PHP worker processes
New or modified administrator accounts in wp_users that were not created through legitimate workflows
Access log entries with unusually long query strings targeting the plugin's front-end form parameters

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag SQL injection signatures on requests routed to the plugin's URIs
Correlate web server access logs with database query logs to identify parameterized queries containing tautologies or stacked statements
Inventory WordPress installations and flag those running the Project Management, Bug and Issue Tracking plugin at versions below 5.1.0

Monitoring Recommendations

Enable MySQL general or audit logging on WordPress database hosts and alert on information_schema queries from the application user
Monitor for spikes in HTTP 500 responses or database errors surfaced through PHP error logs, which often accompany blind SQL injection probing
Track authentication events for newly created privileged users and password resets for administrator accounts

How to Mitigate CVE-2026-12877

Immediate Actions Required

Upgrade the Project Management, Bug and Issue Tracking WordPress plugin to version 5.1.0 or later on all WordPress sites
Audit wp_users, wp_usermeta, and plugin-specific tables for unauthorized modifications since the plugin was installed
Rotate WordPress administrator passwords, API keys, and secret keys defined in wp-config.php if compromise is suspected
Review database user privileges and ensure the WordPress database account cannot execute administrative statements it does not need

Patch Information

The vendor addressed the SQL injection in version 5.1.0 of the plugin by introducing proper input sanitization and prepared statements. Site administrators should update through the WordPress plugin manager or by replacing the plugin files from the official repository. Refer to the WPScan Vulnerability Detail for advisory metadata.

Workarounds

Temporarily deactivate the plugin until the upgrade to 5.1.0 or later is complete
Restrict access to the plugin's front-end issue-tracker endpoints using HTTP authentication, IP allowlists, or an authenticated-only reverse proxy
Deploy WAF virtual patching rules that block SQL metacharacters and known injection patterns targeting the plugin URIs

bash

# Example WAF rule fragment blocking SQL injection on plugin endpoints
# Adapt regex and location to your WAF platform
SecRule REQUEST_URI "@contains /wp-content/plugins/wp-project-manager" \
  "phase:2,deny,status:403,\
   chain,\
   msg:'Potential SQLi against vulnerable Project Management plugin (CVE-2026-12877)'"
  SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|information_schema)" "t:none,t:urlDecodeUni"