CVE-2026-12741 is a SQL Injection vulnerability in the WP Fast Total Search – The Power of Indexed Search WordPress plugin by epsiloncool. The issue arises from improper neutralization of special elements in the 'form_data[s]' parameter, allowing unauthenticated attackers to append malicious SQL queries. This is due to insufficient escaping of user input and lack of prepared statements in the affected versions up to 1.80.280. The vulnerability can be exploited to extract sensitive information from the database without authentication. No known exploits in the wild have been reported, and no official remediation or patch is currently documented.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information stored in the database. The attacker does not require authentication and can manipulate SQL queries to extract data. The vulnerability does not impact data integrity or availability directly according to the available information. The CVSS score of 7.5 reflects a high impact on confidentiality with no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for updates from the vendor or security advisories is recommended to apply any future patches promptly.