CVE-2026-18666

UNKNOWN 0.0

Library Management System < 3.6.7 - Subscriber+ SQL Injection via Filter Value

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.

Vendor	unknown
Product	library management system
Published	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for unknown library management system

Be the first to know when new unknown vulnerabilities affecting unknown library management system are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Library Management System

0 < 3.6.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/7a9b3fff-f454-4764-ad60-0b273781f7b4/

Credits

João Ramos Maciel WPScan