Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS lifterlms allows SQL Injection.This issue affects LifterLMS: from n/a through <= 8.0.6.
Published: 2025-06-27
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is an improper neutralization of special elements used in an SQL command, classified as SQL injection (CWE-89). An attacker can craft input that the LifterLMS plugin processes without proper sanitization, leading to execution of arbitrary SQL statements against the WordPress database. This enables the attacker to read, alter, or delete application data, potentially compromising the confidentiality and integrity of the site’s content and user information.

Affected Systems

The vulnerability affects the WordPress LifterLMS plugin developed by chrisbadgett. Any installation of LifterLMS version 8.0.6 or earlier is potentially exploitable. Users running these versions should verify their installed version and consider an upgrade if available.

Risk and Exploitability

The CVSS score of 9.3 indicates a high severity risk. The EPSS score of less than 1% suggests that exploitation is currently rare, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, via the web interface of the plugin, as the injection point is reachable through user-supplied input in the plugin’s functionality. Consequently, administrators should treat this as a potentially high‑impact issue, chiefly concerned with data confidentiality and integrity.

Generated by OpenCVE AI on April 30, 2026 at 10:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the LifterLMS plugin to version 8.0.7 or later.
  • If an immediate upgrade is not possible, disable or uninstall the vulnerable plugin until the fix is applied.
  • Deploy or configure a web application firewall to block SQL injection patterns targeting the plugin’s input points.
  • Implement role‑based access controls so that only trusted administrators can interface with the plugin’s settings and data manipulation features.

Generated by OpenCVE AI on April 30, 2026 at 10:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-19292 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS allows SQL Injection. This issue affects LifterLMS: from n/a through 8.0.6.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS allows SQL Injection. This issue affects LifterLMS: from n/a through 8.0.6. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS lifterlms allows SQL Injection.This issue affects LifterLMS: from n/a through <= 8.0.6.
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00039}

 epss

{'score': 0.0004}

Fri, 11 Jul 2025 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Lifterlms
Lifterlms lifterlms
CPEs cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:wordpress:*:*
Vendors & Products Lifterlms
Lifterlms lifterlms

Fri, 27 Jun 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 27 Jun 2025 12:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS allows SQL Injection. This issue affects LifterLMS: from n/a through 8.0.6.
Title WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Lifterlms Lifterlms
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:17.321Z

Reserved: 2025-06-19T10:02:25.008Z

Link: CVE-2025-52717

cve-icon Vulnrichment

Updated: 2025-06-27T14:38:14.999Z

cve-icon NVD

Status : Modified

Published: 2025-06-27T12:15:39.220

Modified: 2026-04-23T15:32:04.550

Link: CVE-2025-52717

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T10:30:34Z

Weaknesses