What is the CVSS score of CVE-2026-12741?

CVE-2026-12741 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

WP Fast Total Search CVE-2026-12741

EUVD-2026-49716 HIGH

SQL Injection (CWE-89)

2026-07-28 security@wordfence.com

GHSA-235p-5qrp-j5rw

SQLi WordPress

7.5

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network access, low complexity, no user interaction; high confidentiality impact, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 08:31 vuln.today

CVE Published

Jul 28, 2026 - 08:17 nvd

HIGH 7.5

DescriptionCVE.org

The WP Fast Total Search - The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Articles & Coverage 1

News 19 New WordPress Vulnerabilities - 2 Critical, 17 High Jul 29, 2026

AnalysisAI

Remote unauthenticated SQL injection in the WordPress WP Fast Total Search plugin up to version 1.80.280 allows attackers to extract sensitive database information via the 'form_data[s]' parameter. The flaw requires no authentication or user interaction, making it easily exploitable over the network. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send HTTP request with malicious SQL in form_data[s]

Exploit

Trigger SQL injection in plugin search query

Impact

Extract sensitive database information

Access

Send HTTP request with malicious SQL in form_data[s]

Exploit

Trigger SQL injection in plugin search query

Impact

Extract sensitive database information

Vulnerability AssessmentAI

Exploitation	No special conditions required - the vulnerable WP Fast Total Search plugin must be installed and active on the WordPress site. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a remotely exploitable flaw with low attack complexity and no privileges required, impacting confidentiality only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a crafted HTTP request to a vulnerable WordPress site, injecting SQL payloads via the 'form_data[s]' parameter. The malicious query executes in the plugin's search database call, allowing the extraction of sensitive data such as user credentials or personal information without user interaction or prior authentication.
Remediation	No patched version higher than 1.80.280 has been released by the vendor at this time. … Detailed patch versions, workarounds, and compensating controls in full report.