Can blind SQL injection in WPLMS pre-1.9.9.8.2 leak data via CVE-2026-96327?

The short version

• VibeThemes WPLMS plugin has a critical security vulnerability.
• The issue allows blind SQL injection attacks on sites.
• Versions before 1.9.9.8.2 are affected by this flaw.

The details

The National Vulnerability Database recorded CVE-2026-96327 as a critical severity issue with a CVSS score of 9.3. This rating reflects the high potential for damage if an attacker successfully exploits the vulnerability. The flaw stems from improper neutralisation of special elements used in SQL commands, specifically enabling blind SQL injection. According to the NVD record, this weakness is classified under CWE-89, which covers SQL injection vulnerabilities.

The vulnerability exists within the VibeThemes WPLMS plugin, a tool widely used for learning management systems on WordPress platforms. Users running versions of the plugin prior to 1.9.9.8.2 are directly affected by this security gap. The description notes that the issue allows attackers to perform blind SQL injection, a technique where the attacker sends data to the database and infers information based on the application's response. This method can expose sensitive data even if the results are not directly displayed to the user.

The context

SQL injection remains one of the most dangerous web application vulnerabilities. It occurs when user input is not properly sanitised before being included in database queries. In this specific case, the WPLMS plugin failed to neutralise special characters effectively. This oversight allows malicious actors to manipulate the database commands executed by the application. The blind nature of the injection means that while the attacker may not see the data directly, they can deduce its contents through subtle changes in the application's behaviour or error messages. This type of attack can lead to significant data breaches, including the theft of user credentials or private information.

Next steps

Site administrators should immediately audit their WordPress installations for the WPLMS plugin. If the installed version is older than 1.9.9.8.2, they must update to the latest version provided by VibeThemes. Until the update is applied, sites may remain exposed to potential exploitation. Monitoring server logs for unusual database activity can help detect ongoing attacks.

Background: WordPress plugin vulnerabilities

WordPress plugin vulnerabilities occur when developers fail to sanitise data or restrict capabilities. You reduce risk by auditing active plugins for unused features, enforcing strict input validation, and applying security patches immediately. Remove any plugin that lacks recent updates or clear maintenance signals.

Read the full guide: WordPress Plugin Vulnerabilities: Causes, Consequences and Closures

What to do and how to stay safe: VibeThemes

• Check your WordPress dashboard to verify the current WPLMS plugin version.
• Update the plugin to version 1.9.9.8.2 or later as soon as possible.
• Review database logs for any signs of unauthorised query execution.
• Implement a web application firewall to filter suspicious SQL requests.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-96327?

It is a critical SQL injection vulnerability in the VibeThemes WPLMS WordPress plugin.

Which versions are affected?

All versions of WPLMS before 1.9.9.8.2 are affected by this security flaw.

How severe is this vulnerability?

It is rated critical with a CVSS score of 9.3 by the NVD.