Is CVE-2026-115934 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115934 being exploited in the wild.

How severe is CVE-2026-115934?

Critical severity, with a CVSS score of 9.8, published 9 November 2026.

Which products and versions are affected?

Craft CMS before 4.18.9 and 5.x before 5.11.2.

How is CVE-2026-115934 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115934?

Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115934: Craft CMS SQL injection in craft.search

CVE-2026-115934 · Severity: critical · CVSS 9.8 · Published 2026-11-09

Craft CMS, a content management system used to build websites and digital experiences, contains an unauthenticated SQL injection vulnerability in its search functionality that affects MySQL and MariaDB databases. An attacker can inject malicious SQL commands through search parameters without logging in, gaining full read and write access to the database and enabling account takeover by escalating privileges to administrator level.

Technologies: Craft CMS. Vendors: Craft.

Quick answers

Is CVE-2026-115934 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115934 being exploited in the wild.
How severe is CVE-2026-115934?: Critical severity, with a CVSS score of 9.8, published 9 November 2026.
Which products and versions are affected?: Craft CMS before 4.18.9 and 5.x before 5.11.2.
Is there a fix for CVE-2026-115934?: Yes: fixed in Craft CMS 4.18.9 and 5.11.2. Until then: Block front-end requests containing %5Battribute%5D or [attribute] in the query string until the patched versions can be deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115934 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115934?: Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Craft CMS 4.18.9 and 5.11.2

Block front-end requests containing %5Battribute%5D or [attribute] in the query string until the patched versions can be deployed.

Technical details

An unsanitized attribute parameter is concatenated directly into SQL queries used by craft.search. Because PDO is configured with emulated prepares disabled, stacked SQL statements execute, allowing unauthenticated remote code execution against the database. Attackers can set the admin flag on any user account or overwrite password hashes, bypassing Craft's permission checks.

Affected products

Craft CMS before 4.18.9 and 5.x before 5.11.2

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.