External risk intelligence

Project Management Bug and Issue Tracking Plugin SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-12877

The vulnerability affects a WordPress plugin configured for a front-end issue tracker. Such plugins are typically deployed as public-facing web interfaces accessible to users over the internet to manage issues, making the affected surface commonly exposed in standard web deployments.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability identified in a WordPress plugin used for project management and issue tracking. The flaw, which allows for SQL injection, could enable unauthorized access to or manipulation of data within the plugin's front-end issue tracker. The primary concern is to confirm if this specific plugin and its affected configuration are in use within our environment.

Unauthenticated attackers can inject malicious SQL code.
High impact if our affected plugin is exposed.
Confirm relevance and exposure of this plugin.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending specially crafted input to the vulnerable WordPress plugin's front-end issue tracker. This input is not properly sanitized before being used in a database query, allowing the attacker to inject malicious SQL commands. Successful exploitation could lead to unauthorized access to sensitive data or modification of database contents.

No authentication required to access.
Input sent to front-end issue tracker.
SQL injection leads to data compromise.

Live Threat

Current exploitation, exposure, and threat context

The Project Management, Bug and Issue Tracking Plugin for WordPress, when configured with its standard front-end issue tracker, is susceptible to SQL injection attacks. This could allow unauthenticated attackers to manipulate database queries, potentially impacting the integrity and confidentiality of data managed by the plugin.

Data in the issue tracker.
Unsanitized input in SQL queries.
Database corruption or unauthorized data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical SQL injection vulnerability in the Project Management, Bug and Issue Tracking Plugin for WordPress impacts unauthenticated users and is exploitable in its standard front-end configuration. Identifying all instances of this plugin, verifying exposure and business criticality, and confirming the accountable owner are the immediate first steps before planning remediation.

WordPress administrators and application owners.
Confirm plugin presence and front-end accessibility.
Assess impact and plan vendor-coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Project Management, Bug and Issue Tracking Plugin?

It is a WordPress plugin designed to help teams organize projects and track bugs or issues directly within their website. It typically provides a front-end interface where users can submit, view, and manage task-related information, centralizing communication and workflow tracking for project management directly in the CMS environment.

What does SQL injection mean for CVE-2026-12877?

This vulnerability, classified as CWE-287, happens when the plugin fails to clean user input before processing it. Because the input is not sanitized, an attacker can insert their own database commands. This allows them to trick the system into executing unauthorized SQL queries, potentially giving them the ability to view, modify, or corrupt the data stored in the plugin's database tables.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by sending malicious input through the plugin's standard front-end issue tracker. Because the software does not properly check this data, the system accepts it as part of a legitimate database query. It is important to note that this requires the front-end tracking features to be active; the bug is not triggered by internal administrative actions that do not interact with these public-facing input fields.

Why does Halo Surface Signal categorize this as likely relevant?

Halo Surface Signal identifies this as likely relevant because the plugin is designed to function as a public-facing web interface. Since these issue trackers are meant to be accessible over the internet for user collaboration, they frequently reside on the edge of the network. This accessibility makes it easier for an unauthenticated attacker to reach the vulnerable code compared to software confined to an internal-only network.

What should I do if I use this WordPress plugin?

First, verify if you are running a version before 5.1.0 and confirm if the front-end issue tracker is enabled. Locate the accountable owner for the site to assess the business impact of the plugin's data. Once these details are confirmed, prioritize updating to a secure version provided by the vendor to remove the vulnerability and protect your database from unauthorized query manipulation.

References

wpscan.com/vulnerability/e9d0ea92-1046-457b-9619-38b61848e36a/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.