What is the CVSS score of CVE-2026-12512?

CVE-2026-12512 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Quotes Llama are affected by CVE-2026-12512?

The Quotes Llama WordPress plugin (versions prior to 3.1.6) contains a SQL injection vulnerability allowing unauthenticated attackers to extract sensitive database contents, including user password…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12512?

Yes, a public proof-of-concept exploit is available for CVE-2026-12512. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-12512?

Within 24 hours, inventory all WordPress installations and identify those running the Quotes Llama plugin via admin dashboard or automated scanning tools. Within 7 days, upgrade all affected installations to Quotes Llama version 3.1.6 or later through the WordPress plugin management interface or command-line tools. Within 30 days, verify successful patch deployment across all systems, review database access logs for suspicious queries (UNION-based SQL patterns), and initiate a credential rotation for any database users accessed by compromised accounts, particularly administrative accounts.

Quotes Llama CVE-2026-12512

EUVD-2026-44595 HIGH

SQL Injection (CWE-89)

2026-07-15 WPScan

GHSA-ggv5-9w8q-wh8j

WordPress SQLi Quotes Llama Unknown

8.6

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) reads arbitrary DB data (C:H) but does not write or disrupt (I:N/A:N); DB is within the app's authority so S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 11:23 vuln.today

CVSS changed

Jul 15, 2026 - 11:22 NVD

8.6 (HIGH)

Patch available

Jul 15, 2026 - 07:02 EUVD

CVE Published

Jul 15, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 15, 2026 - 06:00 cve.org

HIGH 8.6

DescriptionCVE.org

The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.

Articles & Coverage 1

News 4 New WordPress Vulnerabilities - 4 High Severity, 2 With POC Jul 16, 2026

AnalysisAI

UNION-based SQL injection in the Quotes Llama WordPress plugin (all versions before 3.1.6) lets unauthenticated remote attackers inject arbitrary SQL through an unsanitized request parameter and read any data from the WordPress database, including user password hashes. Publicly available exploit code exists and a vendor patch has been released; the flaw carries a high EPSS-relevant profile because it is remotely reachable with no authentication or user interaction. This is no public exploit identified as actively exploited (not in CISA KEV), but working PoC availability makes opportunistic mass-scanning likely.

Technical ContextAI

The vulnerability is a classic CWE-89 SQL injection: a user-supplied parameter is concatenated into a SQL statement without proper sanitization or parameterization (WordPress plugins should use $wpdb->prepare() but this code path does not). Because the injection supports the UNION operator, an attacker can append their own SELECT to the original query and exfiltrate columns from arbitrary tables such as wp_users. The affected component is the Quotes Llama plugin for WordPress (CPE cpe:2.3:a:unknown:quotes_llama), a PHP add-on running inside the WordPress request lifecycle, so any query it exposes to unauthenticated visitors becomes an entry point into the shared MySQL/MariaDB backend.

RemediationAI

Vendor-released patch: update the Quotes Llama plugin to version 3.1.6 or later, which is the primary and complete fix. If immediate patching is not possible, place the WordPress site behind a WAF with rules that block SQL injection patterns (particularly UNION SELECT syntax) targeting the plugin's parameters, and consider deactivating the Quotes Llama plugin entirely until it can be updated - deactivation removes the vulnerable code path but also removes the plugin's functionality from the site. Restrict database privileges for the WordPress DB user to the minimum required as a defense-in-depth measure (this limits blast radius but does not prevent reads of application tables). Consult the WPScan advisory (https://wpscan.com/vulnerability/39d038f6-f009-4274-a8a7-9d7c2597ec85/) for confirmation of the fixed version before deploying.