CVE-2026-96327: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in VibeThemes WPLMS

The vulnerability CVE-2026-96327 in VibeThemes WPLMS plugin arises from improper neutralization of special elements used in SQL commands, enabling Blind SQL Injection attacks. This flaw affects all versions from the initial release up to version 1.9.9.8.2 (exclusive). The CVSS 3.1 score of 9.3 reflects a network attack vector with low attack complexity, no privileges or user interaction required, and a scope change. The impact includes high confidentiality loss and low availability impact, but no integrity impact. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to extract sensitive information from the database through Blind SQL Injection. The confidentiality of the system is highly impacted, while integrity is not affected and availability impact is low. This could lead to data leakage or unauthorized data access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, users should monitor vendor communications for updates and consider restricting access to the affected plugin or applying temporary mitigations if available.