What is the CVSS score of CVE-2026-12877?

CVE-2026-12877 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-12877?

Yes, a public proof-of-concept exploit is available for CVE-2026-12877. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-12877?

Yes, a patch is available for CVE-2026-12877. Update the affected software to the latest version immediately.

Project Management Bug And Issue Tracking Plugin CVE-2026-12877

EUVD-2026-48492 CRITICAL

Improper Authentication (CWE-287)

2026-07-24 WPScan

GHSA-6v2p-hv27-r8xg

WordPress Authentication Bypass SQLi Project Management Bug And Issue Tracking Plugin Unknown

9.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 11:55 vuln.today

CVSS changed

Jul 24, 2026 - 20:22 NVD

9.1 (CRITICAL)

Patch available

Jul 24, 2026 - 08:47 EUVD

CVE Published

Jul 24, 2026 - 06:00 cve.org

CRITICAL 9.1

CVE Published

Jul 24, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

AnalysisAI

Unauthenticated SQL injection in the 'Project Management, Bug and Issue Tracking Plugin' for WordPress before version 5.1.0 enables remote attackers to extract or modify database contents via the standard front-end issue tracker. Exploit code is publicly available, and the vulnerability has a high CVSS score of 9.1, though EPSS probability remains low at 0.14%.