CVE-2026-96327: WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability

Q: Which installations are affected?

WPLMS versions earlier than 1.9.9.8.2 are affected. The available data does not identify any configuration prerequisite or affected WordPress version.

Q: Does exploitation require an authenticated WordPress user or user interaction?

No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the likely impact if exploitation succeeds?

The vulnerability allows blind SQL injection. The provided severity vector indicates high confidentiality impact, no integrity impact, and low availability impact, with scope changed.

Q: What remediation version is identified?

Update WPLMS to version 1.9.9.8.2 or later. The data does not provide an alternative mitigation for environments where updating cannot be done immediately.

Published Oct 9, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplmsplugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.

Affected Software

1 affected component

VibeThemes WPLMS<1.9.9.8.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WPLMS plugin to a version that resolves this vulnerability.
Fixed in 1.9.9.8.2

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

WPLMS versions earlier than 1.9.9.8.2 are affected. The available data does not identify any configuration prerequisite or affected WordPress version.

Does exploitation require an authenticated WordPress user or user interaction?

No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the likely impact if exploitation succeeds?

The vulnerability allows blind SQL injection. The provided severity vector indicates high confidentiality impact, no integrity impact, and low availability impact, with scope changed.

What remediation version is identified?

Update WPLMS to version 1.9.9.8.2 or later. The data does not provide an alternative mitigation for environments where updating cannot be done immediately.

CVE-2026-96327: WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress user or user interaction?

What is the likely impact if exploitation succeeds?

What remediation version is identified?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress user or user interaction?

What is the likely impact if exploitation succeeds?

What remediation version is identified?