PT-2026-27301 · WordPress · Learndash Lms

Published 2026-03-24 · Updated 2026-03-25 · CVE-2026-3079

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LearnDash LMS plugin for WordPress versions prior to 5.0.4

Description The software is susceptible to a blind time-based SQL injection through the filters[orderby order] parameter within the 'learndash propanel template' AJAX action. This is a result of inadequate escaping of user-supplied input and insufficient preparation of the existing SQL query. Authenticated attackers with Contributor-level access or higher can append additional SQL queries to existing ones, potentially allowing them to extract sensitive information from the database.

Recommendations Update to LearnDash LMS plugin version 5.0.4 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3079

Affected Products

Learndash Lms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-3079 · Security Note
• http://learndash.com · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/29a560fa-03bf-435c-85da-68397deab2a6?source=cve · Note
• https://twitter.com/CVEarity/status/2036848463418433888 · Twitter Post
• https://plugins.trac.wordpress.org/browser/sfwd-lms/trunk/includes/ld-reports.php#L1233 · Note
• https://plugins.trac.wordpress.org/browser/sfwd-lms/trunk/includes/reports/includes/class-ld-propanel-activity.php#L338 · Note
• https://plugins.trac.wordpress.org/browser/sfwd-lms/trunk/includes/reports/includes/gutenberg/lib/enqueue-scripts.php#L51 · Note
• https://learndash.com/changelog · Note
• https://plugins.trac.wordpress.org/browser/sfwd-lms/trunk/includes/reports/includes/class-ld-propanel-base-widget.php#L149 · Note