CVE-2026-12741: WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection
The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'formdata[s]' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-fast-total-searchto a version that resolves this vulnerability.Fixed in 1.80.280
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12741?
The severity of CVE-2026-12741 is rated high at 7.5.
What type of vulnerability is CVE-2026-12741?
CVE-2026-12741 is an unauthenticated SQL Injection vulnerability.
What versions are affected by CVE-2026-12741?
CVE-2026-12741 affects all versions of WP Fast Total Search up to and including 1.80.280.
How do I fix CVE-2026-12741?
To fix CVE-2026-12741, update the WP Fast Total Search plugin to a version greater than 1.80.280.
What causes CVE-2026-12741?
CVE-2026-12741 is caused by insufficient escaping on user supplied parameters and a lack of proper SQL preparation.