Craft CMS 5.12 and What Enterprise Teams Should Do Next

Craft CMS 5.12 and What Enterprise Teams Should Do Next

  • Nov 04, 2026
  • Satya Prakash
  • 5 Mins. Read
Share at:

A Craft upgrade is easy to put off when the site looks fine. It gets harder to schedule when three regional teams are preparing a launch, lead forms feed into a CRM, and nobody is sure which version each site is running.

Craft CMS 5.12, released on November 3, 2026, gives marketing teams one place to manage regional versions of an entry and lets headless apps follow each signed-in user’s Craft permissions. It also introduces built-in AI connectivity. If any of your sites run Craft CMS 5.0.0 through 5.11.1, start with the security update. If you’ve already applied the fixes relevant to your site, look at where your team spends time today. Regional publishing and user permissions are two good places to start. Craft 5.12 announcement · Craft security advisory

Which sites should move first?

Start with the version actually installed in each production environment. Two sites that share a brand or codebase can still be on different releases. Record which team owns each site and which customer journeys depend on it.

Production version

What it means

What to do

5.0.0 through 5.11.1

Affected by a high-severity SQL injection vulnerability that can allow an unauthenticated attacker to gain administrator privileges.

Prioritize the update for internet-facing installations. Validate the current stable 5.12 patch in staging, including plugins, custom modules, and integrations.

5.11.2 and later

The SQL injection fix first shipped in 5.11.2. Craft 5.12 also fixes two separate moderate-severity issues.

Check the installed version against Craft’s advisories. Schedule the rollout based on exposure, business impact, and the fixes that apply.

Craft 3 or 4

Moving to 5.12 requires a major-version migration.

Plan hosting, plugin, and custom-code compatibility. For Craft 4, check the advisory for the 4.18.9 fix while preparing the migration. Craft 3 sites need to migrate through Craft 4 first.

At the time of writing, 5.12.0.1 is the latest stable Craft CMS release listed on Packagist. Teams on Craft 5 can update directly within the major version. SQL injection advisory · 5.12 release notes · Craft package history · Craft upgrade documentation

What changes for your teams

Marketing can manage regional publishing from one screen

The new Sites pane lets editors see the versions of an entry they can edit, switch between them, and manage status by site. For a campaign launching in different markets on different dates, a publisher can review the localized entries and verify which versions are enabled from the same editing screen. Editors can also paste files into Assets fields, preview Markdown, and use custom icons or colors with opacity. Craft 5.12 announcement

Engineering can give apps user-level access to Craft

Authenticated GraphQL lets an app work with the permissions of a signed-in Craft user. A headless editorial app could show an editor the drafts they’re allowed to work on. Craft also supports scoped personal access tokens, which users can manage and revoke from their accounts. If your sites already rely on GraphQL, include their existing queries and integrations in the update tests before introducing new authentication flows. Craft 5.12 release notes

Where AI access might help

Craft’s built-in MCP servers let compatible AI tools connect to the CMS. The authenticated server acts within the user’s Craft permissions and the access granted to the tool. The public server exposes content and capabilities an administrator approves. Both are disabled by default, so teams can deploy the update and evaluate MCP separately. One pilot worth trying is to see whether an assistant can help editors find an existing article before they commission a new one. Give it read-only access through a role limited to the content it needs. 

How to roll out Craft 5.12 across several sites

  1. Confirm versions and assign owners. List each production installation, its Craft version, important plugins, and the person accountable for deployment. Prioritize affected internet-facing sites and identify which ones handle revenue, leads, or customer accounts.
  2. Test against a representative site. Use a recent production database copy in staging, review plugin and custom-module compatibility, and run the update there. Start with a staging environment that represents the affected sites and test unusual configurations separately.
  3. Agree on what must work before release. Have engineering verify logins, two-factor authentication, background jobs, and integrations. Have marketing verify scheduled publishing, localized pages, and a real lead form through to its destination in a test environment. Where Commerce is installed, test checkout and payment flows in test mode.
  4. Back up, deploy, and verify. Confirm the database backup and rollback plan before deployment. Afterward, check the installed version, repeat the critical workflow tests, and monitor for errors before rolling out to the next group of sites.

Craft update documentation

If your team needs help keeping Craft and its plugins up to date after the rollout, explore W3care’s Craft CMS maintenance and support. If you have several Craft sites and aren’t sure where to begin, send W3care the versions you’re running and a short list of the workflows each site supports. We can help you decide which sites to update first and what to test before each release. Request a Craft CMS upgrade assessment

Share at:

Let’s Build Something That Works

Share your requirement — our team will get back within 24 hours.
Your information is 100% secure. No spam. No sharing.
  • Subscribe to our Blog