CVE-2026-5207: 
WordPress vulnerability analysis and mitigation

CVE-2026-5207 is a SQL Injection vulnerability in the LifterLMS plugin for WordPress, affecting all versions up to and including 9.2.1. The flaw exists in the handling of the order parameter within quiz reporting functionality, allowing authenticated attackers with Instructor-level access (or higher) who possess the edit_post capability on a quiz to inject malicious SQL queries. It was published on April 11, 2026, with a patch available in versions beyond 9.2.1. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium/Moderate severity) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), arising from insufficient escaping of the user-supplied order parameter and inadequate preparation of the existing SQL query (GitHub Advisory). The vulnerable code resides in llms.table.quiz.non.attempts.php (lines 190 and 240) and is triggered via the AJAX handler in class.llms.ajax.handler.php (line 243), which passes the unsanitized parameter directly into a database query (GitHub Advisory). Exploitation requires network access and a low-privilege authenticated session (Instructor-level or above with edit_post capability on a quiz), but no user interaction is needed. The attack vector is network-based with low complexity, making it straightforward to execute once the preconditions are met.

Successful exploitation allows authenticated attackers to append arbitrary SQL clauses to existing database queries, enabling extraction of sensitive information from the WordPress database — including user credentials, personal data, course content, and other confidential records. The primary impact is a high confidentiality loss, with no direct integrity or availability impact. Depending on the data exposed, this could facilitate further attacks such as account takeover or privilege escalation if password hashes or session tokens are retrieved (GitHub Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.027% (0.000270), placing it in a low percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for an authenticated Instructor-level account with edit_post capability, limiting the attacker pool to users who already have some level of trusted access.

1. Reconnaissance: Identify WordPress sites running LifterLMS version 9.2.1 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain Instructor-level access: Register or compromise an account with Instructor-level privileges and edit_post capability on at least one quiz within the LifterLMS installation.
3. Locate the vulnerable endpoint: Navigate to the quiz reporting section or trigger the relevant AJAX handler (class.llms.ajax.handler.php) that processes the order parameter for quiz non-attempt tables.
4. Craft the SQL injection payload: Manipulate the order parameter in the HTTP request to append additional SQL clauses (e.g., UNION SELECT statements) to extract data from the WordPress database, such as the wp_users table containing usernames and password hashes.
5. Extract sensitive data: Analyze the application's response to retrieve the injected query results, potentially obtaining credentials, email addresses, or other sensitive records stored in the database (GitHub Advisory, Wordfence).

• Network: Unusual HTTP POST or GET requests to WordPress AJAX endpoints (/wp-admin/admin-ajax.php) containing SQL keywords (e.g., UNION, SELECT, FROM, --) in the order parameter.
• Logs: WordPress or web server access logs showing repeated requests to quiz reporting endpoints with anomalous order parameter values; database error logs indicating malformed SQL queries.
• File System: No specific file artifacts are expected from this read-only SQL injection, but unexpected data exports or new admin accounts may indicate post-exploitation activity.
• Database: Unusual or unauthorized queries in database slow query logs targeting wp_users, wp_usermeta, or other sensitive tables originating from the LifterLMS reporting context.

The primary remediation is to update the LifterLMS plugin to a version beyond 9.2.1, which includes the fix applied in changeset 3495818 to llms.table.quiz.non.attempts.php (GitHub Advisory). As a workaround, site administrators should restrict Instructor-level access and the edit_post capability to only fully trusted users. Additionally, deploying a Web Application Firewall (WAF) with rules to detect and block SQL injection patterns in the order parameter can provide interim protection. Monitoring database access logs for suspicious query patterns is also recommended (Wordfence).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for April 6–12, 2026 (Wordfence Weekly Report). The vulnerability received standard automated coverage across CVE tracking platforms and security feeds, with no notable researcher commentary or significant community discussion beyond routine disclosure activity.