WordPress Plugin SQL Injection via Unsanitized User Input

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-12877 represents a critical SQL injection vulnerability in the Project Management, Bug and Issue Tracking Plugin for WordPress, affecting versions before 5.1.0. The plugin fails to properly sanitize and escape user-supplied input before incorporating it into SQL queries, enabling unauthenticated attackers to execute arbitrary SQL commands. This is particularly severe because the vulnerability exists in the standard front-end issue-tracker configuration, meaning any website visitor can exploit it without needing authentication credentials. Organizations running vulnerable versions expose their entire WordPress database to compromise, risking data theft, manipulation, or destruction.

Casky's 283 matching skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify detection signatures for SQL injection payloads in form submissions and URL parameters targeting the plugin's issue-tracker endpoints, recognize anomalous database query patterns that indicate injected SQL clauses, and observe lateral movement attempts following successful database access. The platform's skill mapping helps teams correlate suspicious input validation failures with downstream database activities, enabling them to distinguish between benign user behavior and exploitation attempts—critical context for prioritizing remediation when patching to version 5.1.0 or later.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12877.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-12877

Casky has 283 skills that investigate the attack patterns behind CVE-2026-12877. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn