CVE-2026-12877 is a critical SQL injection vulnerability in the Project Management, Bug and Issue Tracking Plugin for WordPress versions prior to 5.1.0. The plugin fails to sanitize and escape user input before incorporating it into SQL queries, enabling unauthenticated attackers to execute SQL injection attacks via the front-end issue tracker. This vulnerability is classified under CWE-287 (Improper Authentication) and has a CVSS v3.1 base score of 9.1 (Network attack vector, low attack complexity, no privileges required, no user interaction, high confidentiality and integrity impact, no availability impact). No official fix or patch information is currently available.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks, potentially leading to unauthorized access to or modification of sensitive data stored in the plugin's database. The high CVSS score reflects the critical nature of the vulnerability with significant confidentiality and integrity impacts. There is no indication that availability is affected. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected plugin to prevent exploitation. Monitor official vendor channels for updates and apply patches promptly once available.