CVE-2026-3079

Root

Cause The LearnDash LMS WordPress plugin versions up to and including 5.0.3 are vulnerable to blind time-based SQL injection. The vulnerability exists in the learndash_propanel_template AJAX action, specifically through the filters[orderby_order] parameter. The core issue is insufficient escaping of user-supplied input combined with inadequate preparation of the existing SQL query [1][2].

Exploitation

An authenticated attacker with at least Contributor-level access can exploit this flaw by sending a crafted AJAX request. No additional privileges are required beyond a standard Contributor account. The attacker does not need direct database access; they inject malicious SQL code into the orderby_order parameter, which then gets appended to legitimate queries executed by the ProPanel module. The attack is blind time-based, meaning the attacker infers information by observing response timing differences [1][2].

Impact

A successful exploitation allows the attacker to extract any sensitive information stored in the WordPress database. This could include user credentials, personal data, payment details, or other confidential records managed by the site. Because the injection is blind and time-based, data extraction is slow but thorough. The vulnerability does not directly allow remote code execution or file modification, but the potential for data exfiltration represents a serious privacy and security risk [1][2].

Mitigation

The vendor has released a security update addressing this issue. While the specific patched version is not listed in the changelog provided, the advisory notes that LearnDash LMS 5.1.0 is now the minimum supported version for the ProPanel 3.1.05 release [2]. Administrators should update the LearnDash LMS plugin to the latest available version immediately. There are no known workarounds; applying the patched release is the only reliable mitigation.