CVE-2026-5207: The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and i

The LifterLMS plugin for WordPress (a learning management system plugin) has a SQL injection vulnerability (a flaw where attackers can insert malicious database commands into normal queries) in versions up to 9.2.1 through the 'order' parameter. Authenticated attackers with Instructor-level access and above can exploit this to extract sensitive information from the database because the plugin does not properly clean user input before using it in database queries.