What is the CVSS score of CVE-2026-3079?

CVE-2026-3079 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3079?

Organizations using all should be aware of notable risk from CVE-2026-3079, a SQL injection vulnerability rated CVSS 6.5. Exploitation could allow attackers to execute code or inject malicious input.

How to fix or mitigate CVE-2026-3079?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

WordPress CVE-2026-3079

EUVD-2026-14691 MEDIUM

SQL Injection (CWE-89)

2026-03-24 Wordfence

GHSA-6wfv-pvq4-3jvg

WordPress SQLi

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 01:45 euvd

EUVD-2026-14691

Analysis Generated

Mar 24, 2026 - 01:45 vuln.today

CVE Published

Mar 24, 2026 - 01:25 nvd

MEDIUM 6.5

DescriptionCVE.org

The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filters[orderby_order]' parameter in the 'learndash_propanel_template' AJAX action in all versions up to, and including, 5.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

The LearnDash LMS plugin for WordPress contains a blind time-based SQL injection vulnerability in the 'filters[orderby_order]' parameter of the 'learndash_propanel_template' AJAX action, affecting all versions up to and including 5.0.3. Authenticated attackers with Contributor-level access or higher can exploit insufficient input escaping and lack of prepared statements to extract sensitive database information through time-based SQL injection techniques. While the CVSS score of 6.5 reflects medium severity with high confidentiality impact, the requirement for authentication and low network complexity means this poses a real but contained risk, particularly in multi-user WordPress environments where contributor accounts are common.

Technical ContextAI

The vulnerability exists within the LearnDash LMS plugin (identified by CPE cpe:2.3:a:stellarwp:learndash_lms:*:*:*:*:*:*:*:*), a WordPress learning management system developed by StellarWP. The root cause falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which is a classic SQL injection flaw where user-supplied input from the 'filters[orderby_order]' parameter in the AJAX action 'learndash_propanel_template' is concatenated directly into SQL queries without proper escaping or the use of prepared statements. The vulnerable code path appears to involve the reporting modules, specifically in files like class-ld-propanel-base-widget.php and class-ld-propanel-activity.php, where database queries are constructed dynamically. Since this is a blind time-based SQL injection, the attacker cannot see query results directly but can infer data through response timing differences caused by conditional SQL sleep statements.

RemediationAI

Users should upgrade LearnDash LMS to a version released after 5.0.3 that includes SQL injection fixes (consult https://www.learndash.com/changelog/ for the specific patched version number). Until patching is possible, implement strict WordPress user access controls by auditing and minimizing the number of Contributor and Author accounts, restricting these roles only to trusted users, and disabling AJAX actions related to reports and panels if not actively used (via custom filters or WAF rules). Additionally, enforce prepared statements and parameterized queries for all database operations, consider implementing a Web Application Firewall to detect and block blind time-based SQL injection patterns (detecting unusual sleep delays in AJAX requests), and enable comprehensive WordPress security monitoring to detect suspicious contributor account activity or unusual database queries.