EUVD-2026-14691
GHSA-6wfv-pvq4-3jvg
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network accessibility with low attack complexity, but crucially requires Prior Login (PR:L) at the Contributor level or above, which significantly reduces real-world exploitation scope compared to unauthenticated vulnerabilities. The confidentiality impact is high (C:H), meaning an attacker can extract sensitive data, while integrity and availability are not affected. The lack of publicly disclosed EPSS scores, KEV inclusion status, or proof-of-concept code in the provided intelligence suggests this is a lower-priority target for weaponization compared to unauthenticated vulnerabilities, though the attack is automatable and repeatable once an attacker gains contributor access. The realistic risk profile depends heavily on WordPress site hardening: organizations with strict contributor access controls, regular user audits, and rapid patching cycles face lower practical risk, while sites with many contributors, delayed patch cycles, or compromised user accounts face substantially higher risk. This is a legitimate priority for LearnDash administrators but not an emergency-level threat like unauthenticated RCE vulnerabilities. |
| Exploit ScenarioDerived | An attacker with legitimate WordPress Contributor access (or who has compromised a contributor account through phishing or password reuse) navigates to the LearnDash reports panel and crafts a malicious AJAX request to 'learndash_propanel_template' with a time-based SQL injection payload in the 'filters[orderby_order]' parameter, such as appending 'UNION SELECT IF(1=1, SLEEP(5), 0)' or similar conditional sleep statements. By observing response time delays, the attacker systematically extracts database contents including user credentials, course enrollment data, quiz answers, and other sensitive information stored in the WordPress database, all without triggering immediate detection since blind SQL injection leaves minimal audit trail evidence compared to error-based injection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 24, 2026
The LearnDash LMS plugin for WordPress contains a blind time-based SQL injection vulnerability in the 'filters[orderby_order]' parameter of the 'learndash_propanel_template' AJAX action, affecting all versions up to and including 5.0.3. Authenticated attackers with Contributor-level access or higher can exploit insufficient input escaping and lack of prepared statements to extract sensitive database information through time-based SQL injection techniques. While the CVSS score of 6.5 reflects medium severity with high confidentiality impact, the requirement for authentication and low network complexity means this poses a real but contained risk, particularly in multi-user WordPress environments where contributor accounts are common.
RemediationAI
Users should upgrade LearnDash LMS to a version released after 5.0.3 that includes SQL injection fixes (consult https://www.learndash.com/changelog/ for the specific patched version number). Until patching is possible, implement strict WordPress user access controls by auditing and minimizing the number of Contributor and Author accounts, restricting these roles only to trusted users, and disabling AJAX actions related to reports and panels if not actively used (via custom filters or WAF rules). Additionally, enforce prepared statements and parameterized queries for all database operations, consider implementing a Web Application Firewall to detect and block blind time-based SQL injection patterns (detecting unusual sleep delays in AJAX requests), and enable comprehensive WordPress security monitoring to detect suspicious contributor account activity or unusual database queries.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists within the LearnDash LMS plugin (identified by CPE cpe:2.3:a:stellarwp:learndash_lms:*:*:*:*:*:*:*:*), a WordPress learning management system developed by StellarWP. The root cause falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which is a classic SQL injection flaw where user-supplied input from the 'filters[orderby_order]' parameter in the AJAX action 'learndash_propanel_template' is concatenated directly into SQL queries without proper escaping or the use of prepared statements. The vulnerable code path appears to involve the reporting modules, specifically in files like class-ld-propanel-base-widget.php and class-ld-propanel-activity.php, where database queries are constructed dynamically. Since this is a blind time-based SQL injection, the attacker cannot see query results directly but can infer data through response timing differences caused by conditional SQL sleep statements.
Know when Learndash Lms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filters[orderby_order]' parameter in the 'learndash_propanel_template' AJAX action in all versions up to, and including, 5.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Executive ViewAI
Organizations using all should be aware of notable risk from CVE-2026-3079, a SQL injection vulnerability rated CVSS 6.5. Exploitation could allow attackers to execute code or inject malicious input. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Learndash Lms
View allUnrestricted file upload in the LearnDash LMS WordPress plugin (versions ≤5.1.5) allows authenticated subscribers enroll
Authorization bypass in the LearnDash LMS WordPress plugin (versions 4.25.0-5.1.6) allows attackers to enroll arbitrary
Exploit-DB