Quotes Llama CVE-2026-12512

No special conditions - remote unauthenticated exploitation against default configurations of the Quotes Llama WordPress plugin (versions before 3.1.6), because the CVSS vector is AV:N/AC:L/PR:N/UI:N with no authentication or user interaction required. The only real prerequisite is that a target WordPress site has the vulnerable Quotes Llama plugin installed and active and that the injectable parameter/endpoint is reachable by anonymous visitors. Limiting factors are narrow: the impact is confidentiality-only (data read, not write or takeover directly), and exploitation is bounded to the specific plugin - sites not running Quotes Llama, or running 3.1.6+, are unaffected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitability with no privileges or user interaction, and the impact is scoped to confidentiality (C:H, I:N, A:N) - reading data, not modifying it. The reported 8.6 score derives largely from the Scope:Changed judgment; a more conservative same-authority scoping would yield roughly 7.5, but either way this is a genuine high-severity, easily automatable issue. Publicly available exploit code raises real-world priority significantly, and stealing WordPress password hashes can enable offline cracking and account takeover, chaining confidentiality loss into broader compromise. No EPSS figure was supplied in the input and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation - treat this as high-priority patching driven by PoC availability rather than confirmed in-the-wild attacks.

An unauthenticated attacker sends a single crafted HTTP request to a WordPress site running Quotes Llama below 3.1.6, injecting a UNION-based payload into the vulnerable parameter. The response returns data from an appended SELECT, allowing the attacker to dump the wp_users table and harvest usernames and password hashes for offline cracking. Because public PoC code exists and no authentication is required, this can be automated across many sites at scale.