Moodle EUVD-2026-113819

Exploitation requires the External database enrolment plugin (enrol_database) to be enabled and configured against a MySQL or MariaDB external database - a non-default deployment mode. The attacker must hold an editing-teacher role (PR:L) sufficient to set a course's idnumber field, and the malicious backslash-quote payload only executes when the scheduled enrolment sync task runs, so the attacker does not control trigger timing (reflected in AT:P/AC:H). Exploitation is limited to installations using this specific plugin with a MySQL/MariaDB backend; sites not using external-database enrolment, or using a different external DB engine, are not affected by this vector. No end-user interaction is required (UI:N).

The signals converge on a genuine but non-urgent, bounded risk rather than a drop-everything emergency. The CVSS 4.0 base score is 6.0 (medium), and the vector itself tempers the AV:N network reach: AC:H and AT:P mean exploitation is conditional and timing-dependent (the payload only fires when the scheduled enrolment sync runs), and PR:L means the attacker must already hold an editing-teacher role. vuln.today assigns the 'this_month' decision label, consistent with a medium-priority, patch-in-normal-cycle item. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of widespread or active exploitation; the only exploitation signal is a VulnCheck advisory and an abraxaslabs research write-up (a public PoC reference that is not verified as working exploit code). The impact is skewed toward confidentiality (VC:H - reading data from the external MySQL/MariaDB database) with only limited integrity to enrolment results (VI:L) and no availability impact. Net: this is a real priority to schedule for patching, not a high-CVSS-but-illusory issue, but the authenticated-insider prerequisite (editing teacher) plus the non-default external-database enrolment configuration and the scheduled-sync trigger substantially narrow realistic exploitation to environments running that specific plugin against MySQL/MariaDB. EPSS and KEV data are absent - confirm with current feeds before final prioritization.

An attacker holding an editing-teacher role on a Moodle site stores a crafted backslash-quote SQL injection payload in a course's idnumber field. When the External database enrolment plugin's scheduled sync task next runs against a MySQL/MariaDB external database, the injected SQL executes, allowing the attacker to read data and manipulate enrolment results. A public research write-up (abraxaslabs) and VulnCheck advisory exist, but the input does not confirm working, weaponized exploit code.