CVE-2026-3079: LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter
The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filters[orderbyorder]' parameter in the 'learndashpropaneltemplate' AJAX action in all versions up to, and including, 5.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3079?
The severity of CVE-2026-3079 is rated as high due to the potential for authenticated SQL injection attacks.
How do I fix CVE-2026-3079?
To fix CVE-2026-3079, users should update the LearnDash LMS plugin to version 5.0.4 or later.
What versions of LearnDash LMS are affected by CVE-2026-3079?
LearnDash LMS versions up to and including 5.0.3 are affected by CVE-2026-3079.
What kind of attack can be executed due to CVE-2026-3079?
CVE-2026-3079 allows for blind time-based SQL injection attacks via the 'filters[orderby_order]' parameter.
Who is primarily impacted by CVE-2026-3079?
Primarily, users with Contributor+ access on sites running vulnerable versions of LearnDash LMS are impacted by CVE-2026-3079.