Skip to content
Critical SQL Injection Vulnerability in Craft CMS Enables Admin Takeover

Critical SQL Injection Vulnerability in Craft CMS Enables Admin Takeover

First seen 9 Nov 2026, 08:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 08:50 UTC
  • •CVE-2026-123488 allows unauthenticated SQL injection with critical impact.
  • •Patches for affected Craft CMS versions were released on September 17, 2026.
  • •No confirmed exploitation has been reported as of November 7, 2026.

Craft CMS has a critical vulnerability, CVE-2026-123488, allowing unauthenticated SQL injection that grants attackers read and write access to the database. This flaw affects Craft versions 4.18.9 and 5.11.2, enabling unauthorized changes to administrator status and password hashes. The vulnerability stems from unsanitized query parameters in the element endpoint, allowing stacked SQL statements due to the use of emulated PDO prepares. The vendor released patches on September 17, 2026, but the CVE was only published on November 6, 2026, with a public proof of concept appearing the next day. Other related vulnerabilities include CVE-2026-123489, an authenticated blind SQL injection, and CVE-2026-123490, which allows privilege escalation for authenticated users. As of November 7, 2026, there are no confirmed in-the-wild exploitations, but the public proof of concept raises concerns for potential attacks. Users are urged to upgrade immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 7h ago How this analysis works

Timeline

2026-09-17
Patches released for Craft CMS vulnerabilities
Craft CMS released versions 4.18.9 and 5.11.2 to address multiple vulnerabilities, including CVE-2026-123488.
Rescana
2026-10-22
Vendor advisories published
Craft CMS published security advisories detailing the vulnerabilities and fixes for affected versions.
Rescana
2026-11-06
CVE records published
CVE-2026-123488 and related vulnerabilities were published, detailing their impact and severity.
Sploitus
2026-11-06
CVE-2026-123490 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-06
CVE-2026-123488 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-06
CVE-2026-123489 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-07
Public proof of concept released
A proof of concept for CVE-2026-123488 was made publicly available, raising concerns about potential exploitation.
Sploitus

More articles in this cluster (5)

Following this threat?

Track CVE-2026-123488 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 4

Common questions

Which versions of Craft CMS are affected?
Craft CMS versions 4.18.9 and 5.11.2 are affected by CVE-2026-123488.
What should I do to protect my systems?
Upgrade to Craft CMS versions 4.18.9 or 5.11.2 immediately to mitigate the vulnerabilities.
Is there any confirmed exploitation of these vulnerabilities?
As of November 7, 2026, there are no confirmed instances of exploitation in the wild.