Is CVE-2025-63564 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-63564 being exploited in the wild.

How severe is CVE-2025-63564?

Critical severity, with a CVSS score of 9.8, published 23 September 2026.

Which products and versions are affected?

Moodle Socialwall plugin 3.0 through 3.3.

Is there a fix for CVE-2025-63564?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-63564 attacked?

It is attacked over the network.

Am I affected by CVE-2025-63564?

Check whether you run Moodle Socialwall plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-63564: Moodle Socialwall plugin SQL injection

CVE-2025-63564 · Severity: critical · CVSS 9.8 · Published 2026-09-23

The Moodle Socialwall plugin, which adds social networking features to the Moodle learning management system, contains a SQL injection vulnerability that allows attackers to execute arbitrary code through specially crafted HTTP requests. An attacker could exploit this to compromise the confidentiality and integrity of course data, student records, and user credentials stored in Moodle installations that use this plugin.

Vendors: Moodle.

Quick answers

Is CVE-2025-63564 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-63564 being exploited in the wild.
How severe is CVE-2025-63564?: Critical severity, with a CVSS score of 9.8, published 23 September 2026.
Which products and versions are affected?: Moodle Socialwall plugin 3.0 through 3.3.
Is there a fix for CVE-2025-63564?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-63564 attacked?: It is attacked over the network.
Am I affected by CVE-2025-63564?: Check whether you run Moodle Socialwall plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection flaw exists in Moodle Socialwall plugin versions 3.0 through 3.3, allowing remote attackers to inject and execute arbitrary SQL commands via unvalidated HTTP request parameters. The vulnerability requires network access to the Moodle instance but no authentication is explicitly required for the vulnerable endpoint. Successful exploitation grants database-level access enabling data extraction, modification, or deletion.

Affected products

Moodle Socialwall plugin 3.0 through 3.3

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.