CVE-2025-52717 is a critical SQL injection (CVSS 9.3) in the LifterLMS WordPress plugin up to version 8.0.6. Patchstack lists version 8.0.7 as the patched release and says no login is needed to reach it. Update the plugin to 8.0.7 or later, then check your logs.
What's affected
The CVE record, published through Patchstack, says LifterLMS by chrisbadgett is affected from n/a through 8.0.6. The Patchstack page for this issue lists 8.0.7 as the patched version and says the required privilege is unauthenticated. The weakness is CWE-89 (SQL injection).
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. It is network reachable with low complexity, needs no privileges or user action, and has a scope change, with high confidentiality impact and a low availability impact. Patchstack describes the risk as dangerous and expected to become exploited, which is an assessment and not a report of attacks. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and the record does not say it is exploited in the wild.
LifterLMS is a learning management plugin for WordPress, so the affected sites are course and membership sites.
How to check if you're exposed
Read the plugin version from the WordPress admin plugin list, or from a terminal with WP-CLI:
wp plugin list --name=lifterlms --fields=name,version,update
Anything at or below 8.0.6 is affected. Check every WordPress site you run, including staging and old campaign sites, since plugin copies can be forgotten. If you manage many sites, ask your hosting panel or management tool for a list of plugin versions.
After the update, check that the site works for logged in students, and look at your web server and WordPress logs for unusual requests to LifterLMS endpoints before the update, in particular long or odd looking parameter values, and for errors from the database layer around the same times.
What to do now
- Update LifterLMS to 8.0.7 or later on every site. With WP-CLI: wp plugin update lifterlms.
- Take a backup of the site and database first, and test course access afterward.
- If you cannot update right away, take the site offline or put it behind a WAF rule that blocks the plugin endpoints until you can.
- Review logs for suspicious requests from before the update.
- Reset administrator and instructor passwords if the site was exposed for a long time or the logs look wrong.
- Turn on automatic updates for the plugin if your change process allows it.
Why it matters
SQL injection in a widely installed WordPress plugin is attractive to attackers because one flaw reaches thousands of sites, whatever their size. The vulnerable code builds a database query from request data without properly separating the two, so the data can change the query.
The score reflects an unauthenticated attacker who can read the WordPress database. That database holds user accounts, hashed passwords, student records and course content. On a membership site it can also include order and contact information.
WordPress sites depend on plugins that are updated by different people at different times. A routine of checking plugin versions weekly, or enabling automatic updates for trusted plugins, turns a critical advisory like this into a short task.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which LifterLMS version fixes CVE-2025-52717?
Patchstack lists 8.0.7 as the patched version. Versions up to and including 8.0.6 are affected.
Does the attacker need a login?
Patchstack lists the required privilege as unauthenticated, and the CVSS vector requires none, so any visitor to the site could reach the flaw.
Sources
- Safeguard Gold record: https://gold.safeguard.sh/vulnerability/CVE-2025-52717
- Patchstack database entry for LifterLMS 8.0.6 SQL injection, fetched: https://patchstack.com/database/Wordpress/Plugin/lifterlms/vulnerability/wordpress-lifterlms-8-0-6-sql-injection-vulnerability
Last reviewed: 18 October 2026.
