WordPress security by component

LearnDash LMS

Plugin description

LearnDash LMS is a WordPress component with 3 published CVE records in this archive. The latest tracked vulnerability was published Mar 24, 2026; the highest CVE/CNA score is 8.5.

Plugin slug: sfwd-lms

Latest vulnerability

CVE-2026-3079: LearnDash LMS: SQL injection

LearnDash LMS is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 5.0.3.

PublishedMar 24, 2026

Known safe version> 5.0.3

		Safe version
Mar 24, 2026	CVE-2026-3079 LearnDash LMS: SQL injection LearnDash LMS is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 5.0.3.	> 5.0.3	CVE6.5 NVDPending
Jan 27, 2025	CVE-2025-24662 LearnDash LMS: A security weakness LearnDash LMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Oct 31, 2023	CVE-2023-28777 LearnDash LMS: SQL injection LearnDash LMS is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.5 NVD8.8