Critical SQL Injection Flaw Found in VibeThemes WPLMS WordPress Plugin

A critical security vulnerability has been identified in the WPLMS plugin developed by VibeThemes, affecting WordPress sites that have not updated to the latest version. The flaw, classified as a blind SQL injection issue, enables attackers to potentially compromise database integrity and access sensitive information without immediate detection.

The vulnerability is recorded in the National Vulnerability Database (NVD) as CVE-2026-96327. It carries a Common Vulnerability Scoring System (CVSS) base score of 9.3, which categorizes it as critical. The underlying weakness is attributed to improper neutralization of special elements used in SQL commands, specifically mapped to CWE-89. This type of injection allows an attacker to manipulate SQL queries by inserting malicious code, which can lead to unauthorized data access, modification, or deletion.

Technical Details and Impact

The specific nature of this vulnerability is blind SQL injection. Unlike traditional SQL injection where the database response is directly visible to the attacker, blind injection requires the attacker to infer the results of their queries based on the application’s behavior or response time. This can make the attack more subtle and harder to detect in real-time, increasing the potential window for exploitation.

According to the NVD record, the issue stems from how the WPLMS plugin handles user input in its SQL commands. Failure to properly sanitize or neutralize special characters allows malicious payloads to be executed by the database server. This can result in severe consequences for site owners, including data breaches, loss of user credentials, and potential takeover of the underlying server if the database privileges are sufficient.

Affected Versions and Scope

The vulnerability affects the VibeThemes WPLMS plugin, a popular solution for managing learning management systems (LMS) on WordPress platforms. The flaw is present in all versions of the plugin prior to 1.9.9.8.2. Users running any version from the initial release up to, but not including, 1.9.9.8.2 are considered at risk.

Organizations and individuals relying on WPLMS for educational content delivery, student management, or course administration should immediately verify their current plugin version. The widespread use of WordPress and LMS plugins means that this vulnerability could impact a large number of sites globally, particularly those in the education and corporate training sectors.

What should you do?

Site administrators and security professionals should prioritize checking their WordPress installations for the WPLMS plugin. If the plugin is present, the version number must be compared against the threshold of 1.9.9.8.2. Any version lower than this should be flagged for immediate action.