CVE-2026-115934

Name of the Vulnerable Software and Affected Versions CraftCMS CMS versions prior to 4.18.9 CraftCMS CMS versions prior to 5.11.2

Description An unauthenticated SQL injection exists on the front end of sites using the element search endpoint. The issue occurs because the attribute parameter is concatenated into the query without sanitization. When using MySQL or MariaDB with emulated prepares, this allows stacked query execution, granting unauthenticated read and write access to the application database. This can be used to escalate privileges to an administrator by modifying the admin flag for a user or overwriting password hashes.

Recommendations Update to version 4.18.9. Update to version 5.11.2. As a temporary mitigation, block front-end requests containing [attribute] or %5Battribute%5D in the query string.