CVE-2024-56047: WPLMS Learning Management System SQLi Flaw

CVE-2024-56047 Overview

CVE-2024-56047 is a SQL Injection vulnerability affecting the VibeThemes WPLMS WordPress plugin, a learning management system used by online course platforms. The flaw stems from improper neutralization of special elements in SQL commands [CWE-89]. Authenticated attackers with subscriber-level privileges can inject arbitrary SQL statements into database queries. The vulnerability affects all WPLMS versions up to and including 1.9.9.5.3. Successful exploitation compromises confidentiality, integrity, and availability of the underlying WordPress database. Because subscriber accounts are frequently self-registered on WPLMS-powered learning sites, the barrier to exploitation is minimal.

Critical Impact
Authenticated subscribers can extract sensitive data, modify database records, and potentially achieve full site compromise through SQL injection.

Affected Products

VibeThemes WPLMS plugin versions up to 1.9.9.5.3
WordPress sites running the wplms_plugin component
Learning management deployments built on the VibeThemes WordPress LMS stack

Discovery Timeline

2024-12-18 - CVE-2024-56047 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56047

Vulnerability Analysis

The WPLMS plugin fails to sanitize user-supplied input before incorporating it into SQL queries executed against the WordPress database. Any authenticated user holding at least the subscriber role can supply crafted parameters to a vulnerable plugin endpoint. The plugin concatenates these values directly into SQL statements, allowing attackers to break out of the intended query context.

SQL injection at this privilege level is significant because subscriber accounts are typically low-value and easily obtained. Many WPLMS installations permit open user registration for course enrollment, giving attackers direct access to the vulnerable code path without social engineering or credential theft.

Exploitation enables union-based, boolean-based, or time-based extraction of wp_users credentials, session tokens stored in wp_usermeta, and course transaction data. Attackers can also modify records to escalate their own roles or plant persistent backdoors through option-table writes.

Root Cause

The root cause is the absence of prepared statements or parameter binding in the affected plugin queries. The developer used direct string interpolation of request parameters into SQL rather than the $wpdb->prepare() API provided by WordPress. This anti-pattern maps directly to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

The attack is network-based and requires only low privileges. An attacker authenticates as a subscriber, sends a crafted HTTP request to a vulnerable plugin AJAX or REST endpoint, and receives responses that either leak data through response content or through inferred timing. No user interaction is required. Technical exploitation details are documented in the Patchstack advisory.

No verified proof-of-concept code is publicly available for CVE-2024-56047.
See the Patchstack advisory referenced above for technical details.

Detection Methods for CVE-2024-56047

Indicators of Compromise

Unusual admin-ajax.php or REST API requests referencing WPLMS actions with SQL metacharacters such as UNION, SELECT, SLEEP(, or encoded quotes
Spikes in slow database queries originating from PHP workers handling subscriber sessions
New or modified rows in wp_users or wp_usermeta tied to subscriber accounts performing privilege changes
Outbound HTTP requests from the web server following anomalous subscriber activity

Detection Strategies

Deploy a web application firewall (WAF) rule set that flags SQL keywords and tautologies in requests to /wp-admin/admin-ajax.php and /wp-json/wplms/*
Enable MySQL general query logging in staging and inspect queries containing concatenated user-controlled data
Correlate WordPress audit logs with database logs to identify subscribers issuing queries against tables outside normal LMS workflows

Monitoring Recommendations

Monitor for subscriber accounts making high-frequency AJAX calls to WPLMS endpoints within short time windows
Alert on any UPDATE statements against wp_users, wp_options, or wp_usermeta outside scheduled admin activity
Track newly created administrator accounts and role changes as a follow-on indicator of successful exploitation

How to Mitigate CVE-2024-56047

Immediate Actions Required

Upgrade WPLMS to a version later than 1.9.9.5.3 as soon as the vendor patch is available
Audit all existing subscriber accounts and remove those that are inactive or unrecognized
Rotate WordPress secret keys in wp-config.php and force password resets for privileged users
Review database contents for unauthorized administrator accounts or modified plugin options

Patch Information

VibeThemes has addressed the issue in WPLMS releases following 1.9.9.5.3. Refer to the Patchstack advisory for the fixed version reference and vendor guidance. Apply the update through the WordPress plugin manager or by replacing plugin files manually after backing up the site.

Workarounds

Disable open user registration under Settings → General until patching completes
Restrict access to WPLMS AJAX and REST endpoints via WAF rules that block requests containing SQL syntax from subscriber sessions
Temporarily deactivate the WPLMS plugin if course access can be paused, eliminating the vulnerable code path entirely

bash

# Example WP-CLI commands to enumerate and remove suspicious subscribers
wp user list --role=subscriber --fields=ID,user_login,user_registered --format=table
wp user delete <ID> --reassign=1
wp plugin update wplms-plugin