{"id":"CVE-2026-96327","published":"2026-10-09T10:16:43.460","lastModified":"2026-10-09T21:17:07.733","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-8-2-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to perform blind SQL injection against the WPLMS plugin, potentially enabling unauthorized data access and manipulation. The flaw occurs when user input is not properly sanitized before being used in SQL queries.","exploitability":"Exploitation requires no authentication and can be achieved through network-based attacks with minimal preconditions, making it highly accessible to threat actors.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive data from the WordPress database, potentially including user credentials, course information, and other protected content.","remediation":"Upgrade to WPLMS version 1.9.9.8.2 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wp-plugin","blind-sql","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:51:38.179Z"}}