The LearnDash LMS plugin for WordPress contains a blind time‑based SQL injection flaw in the 'learndash_propanel_template' AJAX action. The vulnerability is triggered through the 'filters[orderby_order]' parameter, which does not undergo proper escaping or SQL preparation. By injecting specially crafted SQL, a malicious actor can append additional queries to the original statement, potentially leaking sensitive information from the database. This flaw only affects users who can authenticate with at least Contributor‑level permissions.

Affected systems include all installations of StellarWP's LearnDash LMS plugin for WordPress with version numbers up to and including 5.0.3. No specific sub‑version details are listed beyond that threshold, so any site deploying LearnDash 5.0.3 or earlier remains vulnerable.

The vulnerability has a CVSS score of 6.5, indicating moderate severity, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is not provided, but the requirement for authenticated users limits the scope of exploitation to site administrators who have granted Contributor or higher access. Nonetheless, once authenticated, an attacker can use the time‑based blind injection to gather data; the lack of a public exploit suggests exploitation may still require manual effort. Administrators should treat this as a moderate to high risk due to potential data exposure.