CVE-2026-95607: WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is rated PR:L, indicating that an attacker needs low-level privileges. No user interaction is required.

Q: Can this be exploited remotely?

Yes. The AV:N rating indicates the vulnerable functionality can be reached over a network.

Q: What is the potential impact if exploitation succeeds?

The supplied vector indicates high confidentiality impact, no integrity impact, and low availability impact. The scope is changed, meaning the impact may extend beyond the initially affected security authority.

Q: Which WPLMS versions are affected?

WPLMS versions through 4.973 are affected. The available data does not identify a fixed version.

Published Oct 9, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.

Affected Software

1 affected component

VibeThemes WPLMS<=4.973

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WPLMS theme to a version that resolves this vulnerability.
Fixed in 4.974

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is rated PR:L, indicating that an attacker needs low-level privileges. No user interaction is required.

Can this be exploited remotely?

Yes. The AV:N rating indicates the vulnerable functionality can be reached over a network.

What is the potential impact if exploitation succeeds?

The supplied vector indicates high confidentiality impact, no integrity impact, and low availability impact. The scope is changed, meaning the impact may extend beyond the initially affected security authority.

Which WPLMS versions are affected?

WPLMS versions through 4.973 are affected. The available data does not identify a fixed version.

CVE-2026-95607: WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Can this be exploited remotely?

What is the potential impact if exploitation succeeds?

Which WPLMS versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Can this be exploited remotely?

What is the potential impact if exploitation succeeds?

Which WPLMS versions are affected?