EUVD-2026-95599
GHSA-v9qm-r7hh-x8jh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege WPLMS account
-
DeliverySubmit crafted SQLi payload to vulnerable parameter
-
ExploitBackend executes unsanitized SQL query
-
ExecutionInfer data via blind boolean/time responses
-
ImpactExfiltrate credentials and user PII
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session on the target WordPress site (PR:L), meaning the attacker needs at least a low-privilege account - relevant where WPLMS-based e-learning sites permit open student/subscriber registration, which effectively lowers this barrier to near-anonymous. The affected component is the WPLMS theme by VibeThemes at any version from n/a through 4.973; sites on a patched release above 4.973 are not affected. No special non-default configuration is named in the advisory, but the limiting factors are the authentication requirement and the blind nature of the injection, which makes exfiltration slower (inference-based) than with a classic error-based or union-based SQLi. No user interaction is required (UI:N). |
| Impact | This is a genuine, elevated-priority issue but not a drop-everything emergency based on current signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, score 8.5) indicates a network-exploitable, low-complexity flaw requiring only low-level authentication (PR:L) and no user interaction, which is consistent with a WordPress theme where any registered/subscriber-level account could be the attacker. The data is internally consistent - a blind SQL injection (CWE-89) aligns with C:H (database read via inference) and the low A:L, though the S:C (scope change) and absence of integrity impact (I:N) are debatable for typical SQLi and appear to reflect Patchstack's conservative scoring convention rather than a demonstrated cross-boundary effect. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation likelihood cannot be quantified from the input: no public exploit identified at time of analysis. Net: treat as a high-severity, authenticated SQLi worth prompt patching on exposed WPLMS installations, but real-world mass-exploitation risk is unconfirmed given missing EPSS/KEV/POC data. |
| Exploit ScenarioDerived | An attacker who holds or registers a low-privilege account on a WordPress site running the WPLMS theme (≤4.973) sends crafted input to a vulnerable theme parameter, injecting SQL that the backend fails to neutralize. Because the injection is blind, the attacker infers database contents (user credentials, hashes, PII, course data) through boolean or time-based response differences. Given AV:N/AC:L and no required user interaction, the request is fully remote and scriptable, though it does require an authenticated session (PR:L); no public POC was provided in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, lets an attacker with a logged-in low-privilege account inject SQL into backend queries and extract database contents through inference-based techniques. The authentication requirement (PR:L in the CVSS vector) is the main limiting factor, but it is a weak barrier in practice because many WPLMS-based learning sites allow open student or subscriber self-registration, effectively lowering the entry cost to near-anonymous. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); independent assessment classifies it as a genuine, elevated-priority problem rather than an emergency, with high confidentiality impact (C:H), limited integrity exposure (I:L), and no confirmed availability impact (A:N).
RemediationAI
The primary action is to update the WPLMS theme to a release above version 4.973, since the reported affected range ends at 4.973; because the supplied data does not name an explicit fixed version, verify the exact patched release against the Patchstack advisory (https://patchstack.com/database/wordpress/theme/wplms/vulnerability/wordpress-wplms-theme-4-973-sql-injection-vulnerability?_s_id=cve) before deploying, and treat any release above 4.973 as the minimum target. Where an immediate theme upgrade is not possible, the most effective compensating control is to remove the low-privilege foothold the injection requires: close open student/subscriber self-registration, revoke or downgrade unused subscriber accounts, and restrict account creation to vetted users, accepting that this blocks legitimate enrollment for a course site. Because the injection is blind and inference-based, deploy WAF or ModSecurity SQL-injection rules on requests to WPLMS theme endpoints and enable database query logging or anomaly alerting for repeated time-delayed or boolean-probing patterns, understanding that generic WAF signatures carry a false-positive risk against legitimate course and quiz traffic. Additionally, run the WordPress database user with least privilege (no FILE, no stacked queries, no administrative schema rights) so a successful injection cannot escalate to file writes or privilege changes, and rotate database credentials after any suspected exposure since contents are readable to an attacker who can already authenticate.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPLMS is a commercial WordPress learning-management theme from VibeThemes that extends WordPress with course, quiz, and student-management data stored in custom database tables. The flaw is a classic CWE-89 improper neutralization of special elements used in an SQL command: user-supplied input reaching a database query is not safely parameterized or escaped, allowing injected SQL fragments to alter query logic. Because the injection is blind, the attacker cannot read query output directly and must instead infer data through boolean or time-based responses, which slows exfiltration but does not prevent it. This is a web-facing, network-reachable issue (AV:N/AC:L/UI:N) that requires an authenticated session (PR:L) on the target WordPress site and no special non-default configuration, per the available advisory data. The vendor-supplied vector scores Scope as Changed (S:C), reflecting the crossing of a security boundary between the web application and the database layer, while independent re-scoring treats it as S:U with C:H/I:L/A:N; the difference reflects how aggressively the database compromise is weighted rather than disagreement about the underlying injection. The CPE record (cpe:2.3:a:vibethemes:wplms:*:*:*:*:*:*:*:*) confirms the affected product is the WPLMS theme itself rather than the WordPress core or a companion plugin.
Know when Wplms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Remote, low-complexity blind SQLi needing a low-privilege account (PR:L); high confidentiality via DB read, minor integrity, no scope change demonstrated so S:U.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.
Executive ViewAI
The VibeThemes WPLMS WordPress e-learning theme, through version 4.973, has a high-severity blind SQL injection flaw that could let a low-privilege authenticated user extract sensitive database contents from affected learning platforms. Because many WPLMS sites allow open student or subscriber self-registration, the practical barrier to entry is low, putting student records, credentials, and other institutional data at risk. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, so leadership should prioritize interim mitigations while awaiting a fix.
No vendor-released patch identified at time of analysis; interim mitigations include restricting or disabling open self-registration, deploying WAF or virtual patching rules for SQL injection, enforcing least privilege and monitoring database activity, and considering temporary removal of the WPLMS theme until a fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Blind SQL injection in the VibeThemes WPLMS WordPress learning-management plugin affects every release prior to 1.9.9.8.
Reflected cross-site scripting in the VibeThemes WPLMS WordPress theme (versions 4.972 and earlier) lets a remote, unaut
Exploit-DB