---
id: "CVE-2026-119554"
kind: "vulnerability"
aliases: ["CVE-2026-119554"]
title: "Moodle: SQL injection in external database enrolment via course ID number"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["lms", "mariadb", "moodle", "mysql", "runtime", "self-hosted"]
not_affected_if: ["non-mysql-database", "plugin-disabled"]
published_at: "2026-10-30T12:16:42+00:00"
first_seen_at: "2026-10-30T12:30:26+00:00"
updated_at: "2026-10-30T12:32:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119554", "first_seen_at": "2026-10-30T12:30:26+00:00"}]
---

# Moodle: SQL injection in external database enrolment via course ID number

Editing teachers can store a crafted course idnumber that Moodle's External database enrolment plugin runs as SQL during scheduled sync. On MySQL or MariaDB external databases, an attacker can read data and change enrolment results.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Moodle version under Site administration > Notifications and compare it to the affected ranges.
- Confirm whether the External database enrolment plugin is enabled under Site administration > Plugins > Enrolments.
- Confirm whether the external database connection uses MySQL or MariaDB.

## Fix

- Moodle 5.3.0 and later branches are listed as affected; the sources do not state a fixed version.
- Moodle 5.2.x, 5.1.x, 5.0.x and 4.5.x: the sources list affected ranges but do not state the fixed version.

## Timeline

- 2026-10-30T12:30:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119554

## From the sources

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_