CVE-2026-5207

The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-3358

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing poststatus validation in the enrollnow and courseenrollment functions. Both enrollment endpoints...

CVE-2026-40199

creationtimestamp| type| source ---|---|--- 2026-04-11 01:45:30+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj6pnsttg52t 2026-04-13 18:01:28+00:00| published-proof-of-concept| Telegram/GGU4l3ghB8B3Ai9EUxQ7xduUqm6NQYmTwZHkJoJpqeQPEQk...

CVE-2026-40198

creationtimestamp| type| source ---|---|--- 2026-04-11 01:35:29+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj6p3vdj3r2c 2026-04-13 18:01:00+00:00| seen| Telegram/KWuxeeHSuQ8XCG0I0PmdlmfWtMeROe19MjnJrMoKtHiv8c 2026-04-13 18:01:28+00:00| published-proof-of-concept|...

CVE-2026-5207 LifterLMS <= 9.2.1 - Authenticated (Custom+) SQL Injection via 'order' Parameter

The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-5207

The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-3358

CVE-2026-3358 affects the Tutor LMS WordPress plugin up to version 3.9.7. The root cause is missing post_status validation in enroll_now() and course_enrollment() (no check for private post_status) allowing authenticated users with Subscriber-level access or higher to enroll in private courses vi...

CVE-2026-3358 Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing poststatus validation in the enrollnow and courseenrollment functions. Both enrollment endpoints...

CVE-2026-3358

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing poststatus validation in the enrollnow and courseenrollment functions. Both enrollment endpoints...

PT-2026-32084

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post status validation in the enroll now and course enrollment functions. Both enrollment endpoints...

WordPress plugin Tutor LMS – eLearning and online course solution 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added t...

CVE-2026-40191

creationtimestamp| type| source ---|---|--- 2026-04-10 23:02:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6gjmiwe42x...

CVE-2026-40252

creationtimestamp| type| source ---|---|--- 2026-04-10 22:52:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6fxmmmds2t 2026-04-21 19:24:58+00:00| seen| Telegram/UoNmOvyrT0xD6ttUxw0GWEmNWGrIstm3XawCByymdxwMbjs...

CVE-2026-40242

creationtimestamp| type| source ---|---|--- 2026-04-10 22:32:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6ev3mnrn2o 2026-04-10 23:27:06+00:00| published-proof-of-concept| Telegram/azLV8BVN7oG3TROgln-jCTMw5r1pt6lKfNlckhfBfrofK-k 2026-04-17 03:03:48+00:00| confirmed|...

CVE-2026-40184

creationtimestamp| type| source ---|---|--- 2026-04-10 22:02:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6d6xtf7t2a...

CVE-2026-40185

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:33+00:00| seen| Telegram/EoubZoYE34cwfOKYIK3rDqJUepVUHxboU2AFga2-YHkJtiw 2026-04-10 21:24:55+00:00| published-proof-of-concept| Telegram/4ztR6gRcWXk6YwHnamVGk5ZiVkHzJEoA9sdr8vYKwKHNiwI 2026-04-10 22:08:59+00:00| seen|...

GHSA-FVCV-3M26-PCQX

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:33+00:00| seen| Telegram/EoubZoYE34cwfOKYIK3rDqJUepVUHxboU2AFga2-YHkJtiw 2026-04-12 07:51:50+00:00| seen| https://bsky.app/profile/azu.bsky.social/post/3mjbulrf7362m 2026-04-12 23:10:48+00:00| seen|...

CVE-2026-33710

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:20+00:00| seen| Telegram/ZRwkJT-g6xqpr38tjocBfuP9bsA0qHKZRvqY91xv80DRmI 2026-04-11 07:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7bc2i2zl2m 2026-04-13 02:56:04+00:00| seen|...

CVE-2026-33618

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:11+00:00| seen| Telegram/FBFE1jRDxJPr8K8KBUfFYtlwI9wezi1OF7LpQ32tR7vo 2026-04-10 21:31:05+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mj6bgva46m22 2026-04-11 07:03:47+00:00| seen|...

CVE-2026-33704

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:11+00:00| seen| Telegram/FBFE1jRDxJPr8K8KBUfFYtlwI9wezi1OF7LpQ32tR7vo 2026-04-17 06:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mjocqrr7dy2v...