Back to overview

CVE-2026-12512

Description
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.

Metadata

CVE ID
CVE-2026-12512
State
PUBLISHED
Assigner
WPScan
Reserved
2026-06-17 11:59 UTC
Published
2026-07-15 06:00 UTC
Last updated
2026-07-15 06:00 UTC
Vendor / Product
Unknown / Quotes llama
Sources
cve.org  ·  NVD

Severity & Metrics

No CVSS data available.

Affected products (1)
VendorProductPlatformVersions
Unknown Quotes llama — 0 < 3.1.6
Weakness (CWE)
CWESourceDescription
— cna CWE-89 SQL Injection
References (1)
Back to overview