Software Issue Manager exposes front-end search SQL injection
Software Issue Manager before 5.1.0 rewrites the standard front-end WordPress search query when author limiting and a guest-submitted issue are present. The unauthenticated s parameter is concatenated into the generated SQL without sanitization or escaping, allowing attacker-controlled SQL such as a time-delay expression to reach the database.
- Component
- Project Management, Bug and Issue Tracking Plugin
- Plugin slug
software-issue-manager- Affected
- < 5.1.0
- Safe version
5.1.0- Published
- Jul 24, 2026
This CVE was published Jul 24, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
Update Software Issue Manager to 5.1.0 or later. A source backport should build the rewritten search clause with $wpdb->prepare(), use $wpdb->esc_like() for LIKE values and keep attacker input out of SQL fragments.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.
CVE / CNA vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N