SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-12582

HIGH · CVSS 8.6 EPSS 0.26%

Source: NVD + CISA KEV + EPSS · Published 2026-07-13 · Last synced 2026-08-12

CyberRota Analysis

AI-Generated

The Library Management System WordPress plugin prior to version 3.5.8 is vulnerable to SQL injection due to inadequate sanitization of user-supplied parameters in SQL statements. This flaw allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as user password hashes. WordPress site administrators using this plugin should prioritize immediate updates to mitigate the risk of data breaches.

CVE
CVE-2026-12582
Severity
HIGH
CVSS
8.6
EPSS
0.26%
WordPress

Original NVD Description

The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.