A critical flaw in the Craft CMS content management system lets unauthenticated attackers take over websites by injecting their own commands into the site's database, security researchers have warned. Tracked as CVE-2026-123488, the SQL injection vulnerability scores 9.8 out of 10 under the CVSS 3.1 scale, the highest severity rating.

No login needed

The flaw sits in Craft CMS's element search endpoint, where an “attribute” parameter is added to database queries without being checked. Because the software uses emulated prepared statements, attackers can stack extra commands onto a query, giving them read and write access to the database. From there they can set the administrator flag on a user account or overwrite a password hash to seize control of the site.

Patch now, and mind the old branch

The flaw affects Craft CMS versions 4.0.0 to 4.18.8 and 5.0.0 to 5.11.1, and is fixed in versions 4.18.9 and 5.11.2, released on 17 September. The CVE record was published on 6 November, the same day a public proof-of-concept appeared. No exploitation in the wild has been confirmed and the flaw is not yet on the US CISA exploited-vulnerabilities list, but detection rules are now circulating. Site owners should upgrade immediately, and note that Craft CMS 4 reached the end of security support on 30 April, so 4.18.9 is its final release.