WP Fast Total Search Unauthenticated SQL Injection Vulnerability (CVE-2026-12741) Advisory

Vulnerability Overview Vulnerability Name: WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection CVE ID: CVE-2026-12741 CVSS Score: 7.5 (High) Publication Date: July 27, 2026 Last Updated: July 28, 2026 Researcher: Nabil Irawan - Heroes Cyber Security Impact Scope Software Type: Plugin Software Name: WP Fast Total Search – The Power of Indexed Search Affected Versions: <= 1.80.280 Remediation Patch Status: No known patches available Recommended Measures: Please review the vulnerability details in detail and implement mitigations based on your organization's risk tolerance. It is best to uninstall the affected software and seek alternatives. Vulnerability Description The WP Fast Total Search plugin contains a generic SQL injection vulnerability in the parameter, affecting all versions up to 1.80.280. Due to insufficient preparation of user-supplied parameters and SQL queries, attackers can append additional SQL queries to existing ones, thereby extracting sensitive information from the database. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Related Recent Vulnerabilities Additional Information Wordfence Intelligence: Offers free access to personal and commercial APIs for the WordPress vulnerability database. Notification Service: Install Wordfence to receive the latest vulnerability notifications. Documentation: API documentation is available regarding how to access and use vulnerability data. Contact Information Business Hours: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Support: 24/7 support, 365 days a year, with a response time of 1 hour Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: Used under the terms of the license of Defiant and MITRE Corporation. Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Email: Email Footer Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Products and Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscription Stay Updated: Subscribe to news and updates provided by experienced security professionals. Others Powered by: CENSUS --- The above is a summary of key vulnerability information from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

WP Fast Total Search Unauthenticated SQL Injection Vulnerability (CVE-2026-12741) Advisory

More from this source