VulnSocial

CVE-2026-5207Disclosure

LOWCVSS 6.5 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Instructor-level access and above who have the edit_post capability on the quiz, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 3 mentions (2026-04-11); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-04-11: 3Mentions · 2026-04-18: 1PoC Mentioned / Linked · 2026-04-18: 1Patch / Workaround · 2026-04-11: 1Technical Details · 2026-04-11: 304-1104-18
Signal classification3 categories
Disclosure
250.0%
Patch
125.0%
PoC
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-113
Disclosure2Patch1
2026-04-181
PoC1
Full discourse4 posts
  • NerdieNews@NewsNerdie
    Patch

    Attackers can execute SQL Injection via LifterLMS's 'order' parameter (CVE-2026-5207), risking full database compromise. With a CVSS score of 9.8, patch now to protect your WordPress site. #NerdieNews #CyberSecurity #InfoSec #ZeroDay #DataBreach #WordPress

    Post summary

    A high‑severity SQL injection vulnerability (CVE-2026-5207) in LifterLMS is disclosed with a CVSS of 9.8; a patch has been released to protect WordPress sites.

    01010126
    55 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-5207 The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insufficient esc… https://www.cve.org/CVERecord?id=CVE-2026-5207

    Post summary

    The text reports that LifterLMS plugin versions up to 9.2.1 are susceptible to a SQL injection via the 'order' parameter. No PoC, exploit, or patch information is provided.

    00010128
    57.1K followersView on X
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-5207-lifterlms-version-9-2-1-medium-vulnerability-proof-of-concept CVE-2026-5207 #WordPress plugin #vulnerability lifterlms #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge

    Post summary

    A proof‑of‑concept for CVE-2026-5207 in the LifterLMS WordPress plugin is linked, but no exploit code, active use, patch, or technical details are provided.

    0000051
    6 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-5207 SQL Injection in LifterLMS Plugin for WordPress Versions Up to 9.2.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5207

    Post summary

    The post announces an SQL injection vulnerability (CVE-2026-5207) affecting the LifterLMS Plugin for WordPress up to version 9.2.1, with a reference to a detail page but no PoC, exploit code, or patch information provided.

    0000044
    4.0K followersView on X

Explore more

Back to dashboard