CVE-2026-95607: WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPLMS themeto a version that resolves this vulnerability.Fixed in 4.974
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is rated PR:L, indicating that an attacker needs low-level privileges. No user interaction is required.
Can this be exploited remotely?
Yes. The AV:N rating indicates the vulnerable functionality can be reached over a network.
What is the potential impact if exploitation succeeds?
The supplied vector indicates high confidentiality impact, no integrity impact, and low availability impact. The scope is changed, meaning the impact may extend beyond the initially affected security authority.
Which WPLMS versions are affected?
WPLMS versions through 4.973 are affected. The available data does not identify a fixed version.