PT-2026-32090 · WordPress · Lifterlms Plugin

Momopon1415 · Published 2026-04-11 · Updated 2026-04-11 · CVE-2026-5207

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LifterLMS plugin for WordPress versions up to and including 9.2.1

Description The LifterLMS plugin for WordPress is susceptible to SQL Injection via the order parameter. Insufficient escaping of user-supplied input and inadequate SQL query preparation allow authenticated attackers with Instructor-level access or higher, possessing the edit post capability on the quiz, to append SQL queries and extract sensitive database information.

Recommendations Update to a version later than 9.2.1.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-5207

Affected Products

Lifterlms Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-5207 · Security Note
• https://plugins.trac.wordpress.org/browser/lifterlms/trunk/includes/admin/reporting/tables/llms.table.quiz.non.attempts.php#L190 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/43d31d1e-0f4f-4f51-8274-650151642d03?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2042817806253576296 · Twitter Post
• https://plugins.trac.wordpress.org/browser/lifterlms/trunk/includes/class.llms.ajax.handler.php#L243 · Note
• https://plugins.trac.wordpress.org/browser/lifterlms/trunk/includes/admin/reporting/tables/llms.table.quiz.non.attempts.php#L240 · Note
• https://plugins.trac.wordpress.org/changeset/3495818/lifterlms/trunk/includes/admin/reporting/tables/llms.table.quiz.non.attempts.php · Note