EUVD-2026-95598
GHSA-7wf8-p84v-8jfr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
DeliverySend crafted request to WPLMS endpoint
-
ExploitInject into vulnerable SQL query
-
ExecutionBoolean/time-based blind extraction
-
ImpactExfiltrate database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a target WordPress site running the VibeThemes WPLMS plugin at a version earlier than 1.9.9.8.2. The description provides no 'when configured' clause or named feature, so no special non-default configuration is documented as a prerequisite. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote and needs no user interaction; however, the description does not itself confirm the PR:N unauthenticated claim, and WPLMS SQLi issues have historically often required at least low-privilege (subscriber) authentication - defenders should confirm the required privilege level with the Patchstack advisory. The primary limiting factor is simply having the vulnerable plugin version installed and the vulnerable endpoint reachable. |
| Impact | CVSS base score is 9.3 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating a network-reachable, low-complexity, unauthenticated blind SQL injection (CWE-89) with high confidentiality impact and a changed scope. On paper this is a high-priority flaw. However, the corroborating real-world signals are thin: there is no EPSS probability supplied, no CISA KEV listing, and no public proof-of-concept referenced - so exploitation status is 'no public exploit identified at time of analysis.' The single source is a Patchstack advisory, which is a reliable vulnerability-research origin but does not by itself demonstrate in-the-wild activity. One notable tension: the vector asserts PR:N (unauthenticated), yet the description does not name the vulnerable endpoint or state that access is unauthenticated, and many WPLMS SQLi issues historically require at least subscriber-level authentication - this PR:N claim should be verified against the Patchstack advisory before treating it as fully unauthenticated. Similarly, S:C (scope change) is atypical for a data-read blind SQLi and may be an overestimate. Net: treat as a genuine high-priority patching item for anyone running affected WPLMS versions, but note that the absence of EPSS/KEV/POC means this is a precautionary rather than confirmed-active threat. |
| Exploit ScenarioDerived | A remote attacker sends a crafted HTTP request to a vulnerable WPLMS endpoint containing malicious input that is concatenated into a SQL query, then uses boolean/time-based blind techniques to infer and extract database contents such as user credentials and session data. Because the injection is blind, the attacker iterates request-by-request to reconstruct data rather than receiving it directly. No public exploit code is currently referenced, so exploitation would require an attacker to develop their own payload. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Blind SQL injection in the VibeThemes WPLMS WordPress learning-management plugin affects every release prior to 1.9.9.8.2, letting an attacker who can reach the vulnerable endpoint infer and extract database contents - including WordPress user records and other sensitive tables - through a network-reachable, low-complexity attack (CWE-89, reported CVSS base 9.3). Exploitation status: no public exploit identified at time of analysis, and no CISA KEV listing. Sources disagree on prerequisites - the reported vector carries PR:N/S:C/C:H/I:N/A:L (unauthenticated, changed scope) while our independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (low-privilege authenticated, unchanged scope), so the minimum privilege level required should be verified against the Patchstack advisory before treating the issue as anonymously exploitable.
RemediationAI
Vendor-released patch: 1.9.9.8.2 - update the WPLMS plugin to 1.9.9.8.2 or later through the WordPress plugins screen, WP-CLI (wp plugin update wplms_plugin), or the VibeThemes distribution channel, and confirm the installed version afterwards since cached update metadata can delay the change; verify the fix by re-testing the affected request against the advisory's reproduction guidance. If the update cannot be applied immediately, compensating controls with explicit trade-offs are: deactivate the plugin entirely (eliminates exposure but removes all LMS functionality from the site, so this is only viable for maintenance windows), front the site with a WAF or reverse proxy and enforce SQL-metacharacter and boolean/time-based blind-injection signatures on plugin request paths (effective against known payload shapes but bypassable by encoding tricks and prone to false positives on legitimate form input), restrict access to the plugin's endpoints by IP allow-listing or HTTP authentication at the edge (stops external exploitation but adds friction for legitimate learners and can break API-style integrations), and enable database query logging or a WordPress security plugin to monitor for anomalous or repetitive queries consistent with blind inference (detective only - it does not prevent data extraction and can generate significant log volume). Note that authentication requirements are not consistently confirmed across sources, so do not rely on 'the attacker would need an account' as a mitigant; the advisory at https://patchstack.com/database/wordpress/plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-8-2-sql-injection-vulnerability?_s_id=cve should be checked to confirm the required privilege level, and if exploitation was attempted on an unpatched site, treat database contents - especially wp_users and authentication secrets - as potentially compromised and rotate credentials and salts accordingly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPLMS is a commercial WordPress learning-management-system plugin distributed through the VibeThemes marketplace and the WordPress plugin ecosystem, identified in the affected CPE as cpe:2.3:a:vibethemes:wplms:*:*:*:*:*:*:*:* (the CPE version component is a wildcard, so the version boundary comes from the advisory text rather than the CPE). The root cause is CWE-89, improper neutralization of special elements used in an SQL command: user-controllable input from a plugin request parameter is concatenated into a SQL statement without parameterization or adequate escaping before being handed to the site's MySQL/MariaDB backend. Because the injection is blind, the attacker cannot read query output directly and instead reconstructs data by observing boolean true/false responses or time delays, which makes the attack slower but still capable of full database exfiltration. The reported vector's S:C (changed scope) rating reflects that the injected query executes under the WordPress database account, potentially exposing tables outside the plugin's own schema, whereas the independent assessment applies S:U with confidentiality-only impact (C:H/I:N/A:N) and assumes low-privilege authentication, consistent with the history of WPLMS SQL injection issues that have often required at least subscriber-level access. The description names no specific function or parameter and includes no 'when configured' clause, so there is no documented non-default configuration prerequisite - reachability of the vulnerable endpoint on an unpatched install is the primary exposure condition.
Know when Wplms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Network blind SQLi reads database data (C:H) with no documented write or availability effect (I:N/A:N), scope unchanged; PR:L chosen because WPLMS SQLi typically needs low-privilege authentication and the description does not confirm PR:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.
Articles & Coverage 1
Executive ViewAI
A critical blind SQL injection flaw affects every release of the VibeThemes WPLMS WordPress learning-management plugin prior to 1.9.9.8.2, the platform many organizations run their public-facing learning portals on. Successful exploitation would let an attacker systematically read the underlying database, exposing WordPress user records and other sensitive tables that typically hold student, instructor and staff data - a potential privacy, regulatory-notification and reputational exposure for the institution. No public exploit code or active exploitation has been identified at this time, and sources disagree on whether the attack requires any authentication, so the practical exposure could range from anonymous attackers to any low-privilege authenticated user.
No vendor-released patch identified at time of analysis. Interim mitigations include deploying WAF virtual-patching rules targeting SQL-injection patterns on the affected plugin endpoints, restricting network access to those endpoints to trusted sources or authenticated users, disabling or removing the plugin where it is not business-essential, running the WordPress database connection under a least-privilege account, enforcing MFA and least privilege for WordPress accounts, and monitoring web and database logs for blind SQL-injection probing and unusual data-retrieval volumes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, le
Reflected cross-site scripting in the VibeThemes WPLMS WordPress theme (versions 4.972 and earlier) lets a remote, unaut
Exploit-DB