CVE-2023-28777

WordPress LearnDash LMS Plugin <= 4.5.3 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LearnDash LearnDash LMS allows SQL Injection.This issue affects LearnDash LMS: from n/a through 4.5.3.

Affected

LearnDash · LearnDash LMS

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 PATCHSTACK

8.5 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

EPSS

0.68% chance of exploitation in the next 30 days, 51st percentile

Nuclei

low

Published

2023-10-31

Updated

2026-04-28

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2023/CVE-2023-28777-sfwd_lms-40…

Security advisories

• https://patchstack.com/database/vulnerability/sfwd-lms/wordpress-learndash-lms-plugin-4-5…

References

• CVE Record
• NVD entry