{"id":"CVE-2026-95607","published":"2026-10-09T10:16:42.917","lastModified":"2026-10-09T16:17:32.950","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS  wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/wplms/vulnerability/wordpress-wplms-theme-4-973-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability in VibeThemes WPLMS allows attackers to perform blind SQL injection attacks, potentially leading to unauthorized data access and manipulation. This affects versions through 4.973 and represents a high-severity risk due to the ability to extract sensitive information from the database.","exploitability":"Exploitation requires a low-privilege user account with access to WPLMS functionality, but is relatively straightforward once achieved as it allows blind SQL injection without requiring complex payloads or user interaction.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive user data, modify course content, and potentially escalate privileges within the WordPress environment, affecting all users and courses managed by the vulnerable WPLMS installation.","remediation":"Upgrade to version 4.974 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","web"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:56:09.240Z"}}