CVE Intelligence
Analysis AI-assisted

CVE-2026-96327: VibeThemes WPLMS WordPress Plugin - SQL Injection

The VibeThemes WPLMS WordPress plugin contains an SQL injection weakness (CWE-89) that the record says allows blind SQL injection. The affected range is listed as before 1.9.9.8.2, and the CNA Patchstack assigns a CVSS base score of 9.3 (critical). No confirmed exploitation appears in the sources consulted, and the structured fix data is empty, so the vendor's release notes should be checked.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The VibeThemes WPLMS plugin for WordPress contains an SQL injection weakness classified as CWE-89. The record describes it as allowing blind SQL injection. The CNA is Patchstack, and its entry is available in the Patchstack vulnerability database.

Impact

  • The record assigns a CVSS base score of 9.3, rated critical. The vector indicates network access, low complexity, no privileges and no user interaction required, a changed scope, high confidentiality impact, no integrity impact and low availability impact.
  • Blind SQL injection can let an unauthorized party infer information from the database indirectly. The record does not state which data would be exposed.
  • The EPSS and SSVC values in the record indicate a low modelled exploitation likelihood, but these figures do not replace the severity assessment.

Affected products and versions

  • Product: VibeThemes WPLMS (WordPress plugin, identifier wplms_plugin).
  • Affected range: before 1.9.9.8.2. The record shows no lower bound, using n/a.
  • The description places the boundary at 1.9.9.8.2, but the structured fixes field is empty. Treat the boundary as reported by the source and confirm it against the vendor.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed active exploitation appears in the sources consulted.
  • EPSS gives a probability of 0.0025 with a percentile of 0.1542, dated 2026-10-23.
  • The SSVC record shows exploitation as none and automatable as yes.

Remediation and mitigation

  • Identify every site running WPLMS and confirm the installed version.
  • Update WPLMS to 1.9.9.8.2 or a later release, following the vendor's guidance.
  • If an update cannot be applied immediately, deactivate the plugin where it is not essential and restrict access to affected administrative and public features.
  • Review the NVD record and the CVE record for updates.

Detection guidance

  • Inventory WordPress plugins and flag any WPLMS installation that is older than the fixed boundary.
  • Review web application and database logs for repeated, unusual requests to WPLMS endpoints, or for database errors that appear after such requests.
  • Keep backups and check site integrity after any suspicious activity.

Limitations of the available information

  • The lower bound of the affected range is not stated.
  • The structured fixes field is empty, so the fixed version relies on the description only.
  • No vendor advisory from VibeThemes was available in the record.
  • The record does not describe the exploitation technique, the affected endpoints or the data that could be exposed.
  • The CVSS score comes from the CNA; no separate NVD assessment is included in the record.

Frequently asked questions

Which versions of WPLMS are affected?

The record lists the affected range as before 1.9.9.8.2, with no stated lower bound. The structured fixes field is empty, so confirm the boundary with the vendor.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.