CVE-2026-95607

Summary

A SQL injection vulnerability in VibeThemes WPLMS allows attackers to perform blind SQL injection attacks, potentially leading to unauthorized data access and manipulation. This affects versions through 4.973 and represents a high-severity risk due to the ability to extract sensitive information from the database.

Exploitability

Exploitation requires a low-privilege user account with access to WPLMS functionality, but is relatively straightforward once achieved as it allows blind SQL injection without requiring complex payloads or user interaction.

Blast radius

If exploited, this vulnerability could allow attackers to extract sensitive user data, modify course content, and potentially escalate privileges within the WordPress environment, affecting all users and courses managed by the vulnerable WPLMS installation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.974 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.