Security notice
Run your site on Craft CMS? A flaw in its search lets attackers make themselves an administrator. Update to 5.11.2 or 4.18.9 or later.
Updated November 13, 2026: The Canadian Centre for Cyber Security said open-source reporting indicates this flaw is exploited in the wild, and VulnCheck lists it in its known-exploited catalog. We updated the status, the severity section, the current Craft 5 release (now 5.12.1) and added a note about the separate Mollie plugin update listed in the same Cyber Centre advisory. Previous update: Monday, November 9, 2026, 10:02 AM ET.
Craft CMS 4.0.0 to 4.18.8 and 5.0.0 to 5.11.1 have CVE-2026-123488, an SQL injection in the element search endpoint. An attacker can read and change your site's database, set the administrator flag on an account or overwrite password hashes, and so take full control of the site. Craft fixed it in 4.18.9 and 5.11.2. The CVE was published on November 6, 2026 and exploit code is now public. On November 12, 2026, the Canadian Centre for Cyber Security said open-source reporting indicates the flaw is exploited in the wild. Update to 5.11.2 or 4.18.9 or later; the current releases are 5.12.1 and 4.18.9. (Craft CMS, VulnCheck, NVD)
What happened
- The flaw. In Craft's element search endpoint, one parameter is added to a database query without being cleaned, and the database driver allows extra statements to run after it. That gives read and write access to the whole database. (Craft CMS, NVD)
- What an attacker gets. Craft's advisory shows the write access being used to set the administrator flag on an account. The same access can overwrite any account's password hash. Either way the attacker controls the site. (Craft CMS)
- Login or not. The CVE record from VulnCheck says no login is needed. Craft's advisory title calls it an authenticated flaw, but its impact section says it gives unauthenticated access to the database. Treat it as reachable without a login. (VulnCheck, Craft CMS)
- A second flaw fixed in the same release. CVE-2026-124427 lets anonymous GraphQL clients on Craft 5.0.0 to 5.11.1 read entries from sections you left out of your public GraphQL schema. It only matters if the GraphQL API is turned on. Craft rates it medium; the CVE record rates it 9.8. (Craft CMS, NVD)
- The fix. Craft released 4.18.9 and 5.11.2 on September 17, 2026 and published the advisories on October 22 and 23. The CVEs followed on November 6 and 8. (Packagist, Craft CMS, NVD)
- Severity. VulnCheck, which assigned the CVE, rates the SQL injection CVSS 9.3 under CVSS 4.0 (critical). Craft's advisory currently rates it critical. Proof of concept code has been published. The Canadian Centre for Cyber Security said in a November 12 update to advisory AV26-1086 that open-source reporting indicates CVE-2026-123488 is exploited in the wild. VulnCheck lists the advisory in its known-exploited catalog (VulnCheck KEV); VulnTide, which tracks that catalog, says it has been listed since November 11, 2026. It is still not on the CISA list of known exploited flaws (CISA KEV catalog 2026.11.13, checked November 13, 2026). (Canadian Centre for Cyber Security, VulnCheck, VulnTide, Craft CMS, NVD)
Who should worry
Any site built on Craft CMS 4 before 4.18.9 or Craft CMS 5 before 5.11.2. Craft sites are usually built and looked after by an agency or developer, so the update is theirs to install. If you are not sure what your site runs on, ask them. (Craft CMS)
What to do now
- Update Craft to 5.11.2 or 4.18.9 or later. On Craft 5, the current release is 5.12.1, released November 10, 2026. Back up the site and database first. (Packagist)
- Check your user accounts. In the control panel, look for administrator accounts nobody on your team created, and for users who suddenly cannot log in. Updating closes the flaw; it does not undo changes an attacker already made.
- If you use the GraphQL API, check what your public schema allows. The second flaw exposed entries from sections the schema was meant to hide.
- If you take payments with the Mollie plugin for Craft Commerce, update it to 4.4.3 or later. The Canadian Centre for Cyber Security listed that plugin, prior to 4.4.3, in the same advisory. It is a separate issue from this SQL injection. (Canadian Centre for Cyber Security, Craft CMS)
- If you find anything, treat the site as hacked. Restore the database from a clean backup, reset administrator passwords, and ask your developer to investigate.
What to send your developer, agency or host
Please check which version of Craft CMS our site runs. CVE-2026-123488 is an SQL injection in the element search endpoint (Craft advisory GHSA-qcvp-ggx3-97r6) affecting 4.0.0 to 4.18.8 and 5.0.0 to 5.11.1; it allows read and write access to the database and escalation to administrator, and proof of concept code is public. The Canadian Centre for Cyber Security said on November 12, 2026 that open-source reporting indicates this flaw is exploited in the wild, and VulnCheck lists it in its known-exploited catalog. CVE-2026-124427 (GHSA-xpg7-m6gm-4xfh) is a GraphQL schema scope bypass in 5.0.0 to 5.11.1. Both are fixed in 5.11.2, and the SQL injection in 4.18.9. If we use the Mollie plugin for Craft Commerce, please also update it to 4.4.3 or later (Craft advisory GHSA-3qcx-mjf6-48vj); that is a separate issue listed in the same Cyber Centre advisory. Please update to 5.11.2 or 4.18.9 or later, review administrator accounts and recent password changes, check the public GraphQL schema if it is enabled, and confirm the version you left us on. Sources: Craft CMS, Craft CMS GraphQL advisory, Canadian Centre for Cyber Security, NVD.
Common questions
Does this mean my site was hacked?
No. An old version is a reason to update and check the site, not proof of a break-in. The Canadian Centre for Cyber Security says open-source reporting indicates the flaw is exploited in the wild, so do not wait.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which Craft version your site runs or what is in its database. A scan without a warning about this does not mean your site is safe.
Where can I follow updates?
Follow Craft's security advisory, the Canadian Centre for Cyber Security advisory, the NVD entry and VulnCheck. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Craft CMS: GHSA-qcvp-ggx3-97r6, SQL injection leading to privilege escalation, affected 4.0.0 to before 4.18.9 and 5.0.0 to before 5.11.2, currently rated critical, published October 22, 2026.
- Craft CMS: GHSA-xpg7-m6gm-4xfh, anonymous GraphQL clients can read out-of-scope section content, affected 5.0.0 to before 5.11.2, rated medium, published October 23, 2026.
- VulnCheck: CVE-2026-123488 advisory, unauthenticated SQL injection, CVSS 9.3 (CVSS 4.0), listed in the VulnCheck KEV database.
- NVD: CVE-2026-123488, published November 6, 2026, CVSS 9.8.
- NVD: CVE-2026-124427, published November 8, 2026, CVSS 9.8.
- Packagist: release dates for 4.18.9 and 5.11.2 (September 17, 2026) and the current 5.12.1 (November 10, 2026).
- Canadian Centre for Cyber Security: advisory AV26-1086, Update 1, November 12, 2026, open-source reporting indicates CVE-2026-123488 is exploited in the wild; also lists Commerce-mollie prior to 4.4.3.
- VulnTide: VulnCheck KEV lists CVE-2026-123488 as exploited since November 11, 2026; not in CISA KEV as of November 13, 2026.
- Craft CMS: GHSA-3qcx-mjf6-48vj, separate Mollie plugin issue, affected from 2.1.1 to before 4.4.3, fixed in 4.4.3, published October 23, 2026.