CVE-2026-96327: WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplmsplugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPLMS pluginto a version that resolves this vulnerability.Fixed in 1.9.9.8.2
Event History
Frequently Asked Questions
Which installations are affected?
WPLMS versions earlier than 1.9.9.8.2 are affected. The available data does not identify any configuration prerequisite or affected WordPress version.
Does exploitation require an authenticated WordPress user or user interaction?
No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the likely impact if exploitation succeeds?
The vulnerability allows blind SQL injection. The provided severity vector indicates high confidentiality impact, no integrity impact, and low availability impact, with scope changed.
What remediation version is identified?
Update WPLMS to version 1.9.9.8.2 or later. The data does not provide an alternative mitigation for environments where updating cannot be done immediately.