Moodle CVE-2026-102578

Requires an authenticated Moodle account that has access to the question bank web service (PR:L) - exploitation is not possible for fully anonymous users. The specific feature gate is the question-bank web-service endpoint, which must be reachable and the attacker's account must be permitted to call it. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L). Limiting factors: the requirement for valid low-privilege credentials and for the web service to be exposed/enabled; the precise affected version range is unspecified, so defenders should confirm their Moodle version against the MDL-89383 fix before assessing exposure.

This is a credible, exploitable issue but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity SQL injection requiring only low-privilege authentication and no user interaction - serious once an attacker holds any valid account with question-bank web-service access. However, the corroborating real-world signals are muted: EPSS is only 0.25% (14th percentile), the issue is NOT in CISA KEV, no public exploit code was identified, and CISA SSVC scores Exploitation as 'none' and Automatable as 'no' with only 'partial' Technical Impact. The 'partial' SSVC technical-impact rating sits in mild tension with the CVSS C:H/I:H/A:H 'total' impact; SSVC likely reflects that the attacker must already be authenticated and that compromise is scoped to the database rather than full system takeover. Net: a real, patch-worthy flaw (SQLi reaching sensitive data), but current evidence points to it being a priority driven by product ubiquity and impact severity, not by active or automatable exploitation.

An attacker who holds any authenticated Moodle account with access to the question-bank web service submits crafted, unsanitized input to that service, injecting SQL that the application passes directly into database queries. By manipulating the query, the attacker reads, modifies, or deletes sensitive data (user records, grades, credentials/hashes) in the underlying database. No public proof-of-concept exploit was identified at time of analysis, and exploitation requires valid low-privilege credentials.