WordPress LMS plugin versions 4.2.7 and below suffer from a remote SQL injection vulnerability.