CVE-2026-12582 is an SQL injection vulnerability in the Library Management System WordPress plugin before version 3.5.8. The plugin fails to sanitize and escape a user-supplied parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to perform SQL injection attacks, enabling them to extract arbitrary data from the database, including sensitive information like user password hashes. No CVSS score or official remediation details are available at this time.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive database information, including user password hashes. This compromises the confidentiality of user credentials and may facilitate further attacks such as account takeover or privilege escalation. Since the vulnerability is exploitable by unauthenticated attackers, the risk is elevated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin functionality if possible and monitor for suspicious activity. Avoid using version 3.5 of the plugin in production environments.