CVE-2026-18666 is an SQL injection vulnerability in the Library Management System WordPress plugin prior to version 3.6.7. The vulnerability is due to improper sanitization and escaping of a user-supplied parameter before it is used in a SQL statement. This allows users with Subscriber-level privileges to execute arbitrary SQL commands, potentially extracting sensitive data including password hashes from the database. The vulnerability is publicly known and published but lacks an assigned CVSS score and no official fix or patch has been documented at this time.

Exploitation of this vulnerability allows low-privileged users (Subscribers) to perform SQL injection attacks, which can lead to unauthorized disclosure of sensitive data such as user password hashes. This compromises the confidentiality of the database and potentially the entire WordPress site user base. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level user capabilities if possible and monitor for unusual database activity. Avoid using the vulnerable plugin version in production environments.