SQL Injection Vulnerability in Moodle External Database Enrolment Plugin

CVE-2026-119554

What is CVE-2026-119554?

The External Database Enrolment Plugin integrated into several Moodle versions is prone to an SQL injection vulnerability. Specifically, the vulnerability arises when editing teachers store a backslash-quote payload in the 'idnumber' field. This malicious input is executed during scheduled synchronization with MySQL or MariaDB external databases, allowing an attacker to read sensitive data and potentially manipulate enrolment results. Immediate review and patching of affected Moodle versions are crucial for maintaining data integrity and security.

References