Is CVE-2026-119554 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119554 being exploited in the wild.

How severe is CVE-2026-119554?

Medium severity, with a CVSS score of 5.9, published 30 October 2026.

Which products and versions are affected?

Moodle 4.5.15 and earlier, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, 5.3.0.

Is there a fix for CVE-2026-119554?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119554 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-119554?

Check whether you run Moodle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119554: Moodle SQL injection in External database enrolment plugin

CVE-2026-119554 · Severity: medium · CVSS 5.9 · Published 2026-10-30

Moodle is a learning management system that allows educational institutions to manage courses and student enrollments. The External database enrolment plugin contains a SQL injection vulnerability that allows editing teachers to manipulate course ID numbers with malicious SQL code. When the system performs scheduled synchronization with external databases (MySQL/MariaDB), this injected code executes, potentially exposing sensitive enrollment data or manipulating student enrollment records.

Technologies: Moodle. Vendors: Moodle.

Quick answers

Is CVE-2026-119554 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119554 being exploited in the wild.
How severe is CVE-2026-119554?: Medium severity, with a CVSS score of 5.9, published 30 October 2026.
Which products and versions are affected?: Moodle 4.5.15 and earlier, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, 5.3.0.
Is there a fix for CVE-2026-119554?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119554 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-119554?: Check whether you run Moodle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The External database enrolment plugin (enrol_database) builds SQL queries by concatenating user-supplied course idnumber values with db_addslashes() escaping, which does not properly escape backslashes on MySQL/MariaDB. An authenticated editing teacher can store a backslash-quote payload in the course idnumber field that breaks out of the SQL query context. During the scheduled cron job that syncs with the external database, the injected SQL executes with the privileges of the external database connection, allowing data exfiltration or enrollment manipulation.

Affected products

Moodle Moodle 4.5.15 and earlier, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, 5.3.0

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.