Library Management System CVE-2026-12582

No special conditions - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against default installations of the Library Management System WordPress plugin at any 3.5.x version below 3.5.8. The concrete prerequisite is simply that a vulnerable version of the plugin is installed and its injectable request parameter is reachable over the network; no configuration toggle, feature enablement, or login is required. The main limiting factor is deployment scope: only WordPress sites that have this specific (relatively niche) plugin installed and not yet updated to 3.5.8 are exploitable.

Signals are mixed but lean toward real, opportunistic risk. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H, S:C) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and a scope change, yielding 8.6 (High). SSVC reinforces this: exploitation is at POC stage, the attack is Automatable=yes, and Technical Impact is partial (confidentiality-only, no integrity/availability). Countering that, EPSS is low at 0.18% (7th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active mass exploitation yet. The practical read: a straightforward, scriptable SQLi with public POC that is well within reach of automated WordPress scanners, but current observed exploitation is limited - treat as a prompt-patch item rather than an emergency, while noting that the automatable + unauthenticated combination means opportunistic scanning could raise EPSS quickly.

An attacker finds a WordPress site running Library Management System < 3.5.8 and sends a crafted HTTP request that injects SQL into the vulnerable parameter, requiring no authentication or user interaction. Using the publicly available exploit technique, they enumerate the database and dump the wp_users table, harvesting usernames, emails, and password hashes for offline cracking or credential reuse.