CVE-2026-95607: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in VibeThemes WPLMS

This vulnerability in VibeThemes WPLMS (versions >=0 <4.974) involves improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact scope is changed (scope: changed), with high confidentiality impact and low availability impact, but no integrity impact. No vendor advisory or patch information is provided.

An attacker with low privileges can exploit this vulnerability remotely to perform blind SQL injection, potentially extracting sensitive data (high confidentiality impact) and causing limited denial of service (low availability impact). Integrity is not affected. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is available from the provided data.