How can we help?
Send us a message and we'll get back to you shortly.
Moodle Security in 2026: The CVEs to Patch and What to Do If You Can't Upgrade
In 2026, Moodle disclosed a remote code execution flaw, a SQL injection bug, and a mobile-app token leak. Here is which version is exposed, how to check yours, and what to do when upgrading is not an option yet.
Updated monthly by Cubite, which runs managed Moodle from $690 a month with version upgrades and same-day CVE patching included; last updated 20 October 2026.
On 22 July 2026, Moodle published a security advisory (CVE-2026-18025) warning that its mobile app could read the login tokens a user had saved for other Moodle sites. It was the third serious Moodle vulnerability disclosed in 2026, after a remote code execution flaw and a SQL injection bug earlier in the year. If you self-host Moodle, that run of advisories is your prompt to check exactly which version you are on and what still affects it.
The 2026 Moodle security advisories, in order
Moodle discloses vulnerabilities through its security announcements forum and assigns each one a CVE. Three from 2026 matter most for self-hosted sites, and two of them share a single fix. Here is the short version before the detail. Moodle has published 45 advisories in 2026 so far (MSA-26-0001 to MSA-26-0045, the latest two on 15 October 2026); the full list since September, by release batch, follows the three.
CVE | What it is | Affected versions | Fixed in |
|---|---|---|---|
| CVE-2026-7275 | Remote code execution via the Google Drive repository plugin | 5.1 to 5.1.3, 5.0 to 5.0.6, 4.5 to 4.5.10, and earlier unsupported | 5.1.4, 5.0.7, 4.5.11 |
| CVE-2026-7274 | SQL injection via the external database authentication plugin (auth_db) | 5.1 to 5.1.3, 5.0 to 5.0.6, 4.5 to 4.5.10, and earlier unsupported | 5.1.4, 5.0.7, 4.5.11 |
| CVE-2026-18025 | Moodle mobile app could read web-service tokens saved for other sites | Moodle app 5.2.0 and earlier | Moodle app 5.2.1 |
The two April 2026 advisories (MSA-26-0005 and MSA-26-0006, 29 April 2026), CVE-2026-7275 and CVE-2026-7274, were reported through Moodle's tracker (MDL-88423 and MDL-88138) and are fixed in the same three releases. The July advisory affects the Moodle mobile app, not the server, and is fixed in app version 5.2.1.
Not sure which of these advisories still reach your Moodle?
Run Cubite's free Moodle security audit to see which advisories affect your version, or book a 30-minute review. Managed Moodle with same-day CVE patching starts at $690 a month.
Latest advisories (updated 20 October 2026)
Every Moodle advisory since 9 September 2026, as listed on moodle.org/security. The two September batches are closed by 5.2.2, 5.1.6, 5.0.9 and 4.5.13 (9 September) and by 5.2.3, 5.1.7, 5.0.10 and 4.5.14 (22 September); the 15 October batch is closed by 5.2.4, 5.1.8, 5.0.11 and 4.5.15. The 5.0 releases named here were its last: the branch left security support on 5 October 2026. moodle.org lists the CVE identifier for 15 of these 16 advisories as pending; MSA-26-0045 carries CVE-2026-47759, CVE-2026-47761 and CVE-2026-47762 from the upstream TinyMCE and PrismJS fixes.
| Advisory | Published | What it is | Severity | Affected versions | Fixed in |
|---|---|---|---|---|---|
| MSA-26-0045 | 15 October 2026 | Upgrade TinyMCE and PrismJS including security fixes (upstream) | Minor | 5.2 to 5.2.3 | 5.2.4 |
| MSA-26-0044 | 15 October 2026 | Missing access checks on H5P content files | Serious | 5.2 to 5.2.3, 5.1 to 5.1.7, 5.0 to 5.0.10, 4.5 to 4.5.14 and earlier unsupported versions | 5.2.4, 5.1.8, 5.0.11 and 4.5.15 |
| MSA-26-0043 | 22 September 2026 | Possible to bypass the login notification mechanism | Minor | 5.2 to 5.2.2, 5.1 to 5.1.6, 5.0 to 5.0.9, 4.5 to 4.5.13 and earlier unsupported versions | 5.2.3, 5.1.7, 5.0.10 and 4.5.14 |
| MSA-26-0042 | 22 September 2026 | Blind SQL injection risk in profile availability condition check | Serious | 5.2 to 5.2.2, 5.1 to 5.1.6, 5.0 to 5.0.9, 4.5 to 4.5.13 and earlier unsupported versions | 5.2.3, 5.1.7, 5.0.10 and 4.5.14 |
| MSA-26-0041 | 9 September 2026 | CSRF risk in XML grade imports | Serious | 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions | 5.2.2, 5.1.6, 5.0.9 and 4.5.13 |
| MSA-26-0040 | 9 September 2026 | User list filters do not respect user profile field visibility | Minor | 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions | 5.2.2, 5.1.6, 5.0.9 and 4.5.13 |
| MSA-26-0039 | 9 September 2026 | Minor XSS risk via password reset link | Minor | 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions | 5.2.2, 5.1.6, 5.0.9 and 4.5.13 |
| MSA-26-0038 | 9 September 2026 | Enrolling user to course while selecting group does not validate group belongs to that course | Minor | 5.2 to 5.2.1 and 5.1 to 5.1.5 | 5.2.2 and 5.1.6 |
| MSA-26-0037 | 9 September 2026 | Missing capability checks allow unauthorised triggering of grade penalty recalculation | Minor | 5.2 to 5.2.1, 5.1 to 5.1.5 and 5.0 to 5.0.8 | 5.2.2, 5.1.6 and 5.0.9 |
| MSA-26-0036 | 9 September 2026 | Incorrect capability check in AI editor placement "generate image" service | Minor | 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions | 5.2.2, 5.1.6, 5.0.9 and 4.5.13 |
| MSA-26-0035 | 9 September 2026 | Manual enrolment does not correctly observe disabled state of plugin | Minor | 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions | 5.2.2, 5.1.6, 5.0.9 and 4.5.13 |
| MSA-26-0034 | 9 September 2026 | XSS risk in forum post templates | Minor | 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions | 5.2.2, 5.1.6, 5.0.9 and 4.5.13 |
| MSA-26-0033 | 9 September 2026 | Arbitrary class instantiation via audience classname in core_reportbuilder | Minor | 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions | 5.2.2, 5.1.6, 5.0.9 and 4.5.13 |
| MSA-26-0032 | 9 September 2026 | User profile information disclosure via grade web service | Serious | 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions | 5.2.2, 5.1.6, 5.0.9 and 4.5.13 |
| MSA-26-0031 | 9 September 2026 | SQL injection risk in question bank web service | Serious | 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions | 5.2.2, 5.1.6, 5.0.9 and 4.5.13 |
| MSA-26-0030 | 9 September 2026 | SSRF risk in URL downloader (bypass some blocked hosts) | Serious | 5.2 to 5.2.1, 5.1 to 5.1.5, 5.0 to 5.0.8, 4.5 to 4.5.12 and earlier unsupported versions | 5.2.2, 5.1.6, 5.0.9 and 4.5.13 |
Are you affected? Check your version
Find your exact version under Site administration, Notifications, then read your row. Cubite's monthly Moodle version census counts how many registered sites run each branch, and the Moodle hosting cost guide compares what the hosting options cost.
Your version | Security fixes today | Latest point release | What is still open for you |
|---|---|---|---|
| 5.3.0 | Yes, LTS, until 1 October 2029 | 5.3.0 (5 October 2026) | Nothing published through 15 October 2026 |
| 5.2.4, 5.1.8 or 4.5.15 | Yes | This is the latest | Nothing published through 15 October 2026 |
| 5.2.0 to 5.2.3 | Yes, until 4 October 2027 | 5.2.4 | MSA-26-0044 (serious) and MSA-26-0045, plus every earlier 2026 advisory your point release predates |
| 5.1.0 to 5.1.7 | Security fixes only, until 19 April 2027 | 5.1.8 | MSA-26-0044 and the earlier 2026 advisories your point release predates |
| 4.5.0 to 4.5.14 | Security fixes only, until 4 October 2027 | 4.5.15 | MSA-26-0044 and the earlier 2026 advisories your point release predates |
| 5.0.x | No, since 5 October 2026 | 5.0.11, the last | 5.0.11 closes MSA-26-0044; nothing published after it will be fixed for 5.0 |
| 4.4, 4.3, 4.2, 4.1 LTS, 4.0 and 3.x | No | 4.4.12 and 4.1.22 (December 2025) | Every 2026 advisory that lists "earlier unsupported versions", which is most of them |
What each vulnerability actually lets an attacker do
CVE-2026-7275 is a remote code execution flaw in Moodle's Google Drive repository plugin. Remote code execution is the most serious class of web vulnerability, because it can let an attacker run their own code on the server that hosts your site. If you cannot patch immediately, Moodle's advised workaround is to disable the Google Drive repository plugin.
CVE-2026-7274 is a SQL injection flaw in the external database authentication plugin (auth_db), which some sites use to authenticate users against an outside database. SQL injection can let an attacker manipulate the queries your site runs, putting the confidentiality and integrity of your database at risk. It is fixed in the same 5.1.4, 5.0.7 and 4.5.11 releases.
CVE-2026-18025 is different, because it lives in the Moodle mobile app rather than on your server. A site logged into the app could read the secure-storage tokens for other Moodle sites the same user had configured, which could expose those sites' web-service tokens. Updating the app to version 5.2.1 closes it, so tell your mobile users to update.
Is your Moodle exposed to the 2026 CVEs?
Answer five quick questions to gauge your exposure. Nothing is sent anywhere; the result is calculated in your browser.
Question 1 of 5
1.Which version is your Moodle on?
Why this is harder than 'just update Moodle'
"Patch promptly" is the right advice and the hardest to follow. Moodle ships a new major version about every six months, and pushes security releases for supported branches whenever vulnerabilities are found. Keeping pace sounds simple until you try it on a production site that people depend on every day.
- PHP and database requirements: a newer Moodle needs newer PHP, which can force a server upgrade first.
- Plugin compatibility: a third-party plugin that has not been updated can break on the new version.
- Custom themes and code: bespoke work often needs re-testing or porting before you dare upgrade.
- Downtime and change windows: institutions can only take the site offline at certain times of year.
- Unsupported versions: if you are on 5.0, 4.4, 4.3 or older, there is no security release to apply at all.
None of this is unique to security. It is the same operational drag that shapes the choice between managed and self-hosted Moodle hosting, and it runs through the broader trade-offs of running Moodle. The difference is that a security advisory puts a clock on it.
How to check whether your site is affected
You cannot decide what to do until you know your exact version and which entry points are live. This takes about five minutes inside your own admin area.
Check your exposure in five minutes
- 01
Find your exact version
In Site administration, open Notifications or the Environment page to read your precise Moodle version and patch level. - 02
Match it against the fixed releases
If you are below 5.1.4, 5.0.7 or 4.5.11 on those branches, CVE-2026-7275 and CVE-2026-7274 still affect you. - 03
Audit your plugins
Check whether the Google Drive repository and external database (auth_db) authentication plugins are enabled, since those are the entry points. - 04
Subscribe to advisories
Register your site with Moodle so it notifies you of new security releases before they are made public.
Harden every Moodle site, patched or not
Patching closes the specific holes. These controls shrink the damage of the next one, and most take an afternoon. Work through them regardless of which version you are on.
Moodle security in 2026, by the numbers
- 45
- Moodle security advisories published in 2026 through 15 October (MSA-26-0001 to MSA-26-0045)
- 5.2.4 / 5.1.8 / 4.5.15
- point releases that close every 2026 advisory published to date on the supported branches
- 4
- branches that receive security fixes today: 5.3 LTS, 5.2, 5.1 and 4.5 LTS
- 44.6%
- of registered Moodle sites run a branch with no security fixes (66,408 of 148,822)
What to do if you cannot upgrade right now
Plenty of sites are stuck on an older release for a reason that is not going away this week. That is the same lesson as the 2026 Canvas data breach: your learners' data is only as safe as your least-patched system. The move is to reduce exposure now, not to wait for the perfect upgrade window.
Start by turning off the entry point: for CVE-2026-7275, disable the Google Drive repository plugin. Then get the specific security patches back-ported to your current release, so you close the hole without a full version jump. Cubite's Moodle security audit does exactly this, back-porting critical fixes to older branches such as 3.9, 4.1, 4.3 and 4.4 for teams that cannot upgrade normally yet, and its free tool shows which advisories still affect your exact version.
Where a managed audit helps, and where it does not
Be honest about this. If you run a supported version and apply security releases within days, you are already doing the most important thing, and an audit will mostly confirm it. A well-maintained self-hosted Moodle is a secure Moodle, and you do not need anyone for that.
An audit earns its place in the harder cases: you are several versions behind, an upgrade is blocked by PHP or plugin compatibility, or nobody on the team has time to track advisories. In those situations, knowing precisely which of the 2026 CVEs still reach your install, and getting the fixes without a risky full upgrade, is the difference between a clock that is ticking and a hole that is closed.
Changelog
- 20 October 2026: first monthly update. Added the advisory table (MSA-26-0030 to MSA-26-0045, 9 September to 15 October 2026), the version check table, the link to the Moodle version census, and the note that 5.0 left security support on 5 October 2026, the day 5.3 LTS shipped.
- 7 August 2026: first published, covering CVE-2026-7275, CVE-2026-7274 and CVE-2026-18025.
Frequently asked questions about Moodle security in 2026
Frequently asked questions about Moodle security in 2026
01Is Moodle secure?
02What is CVE-2026-7275?
03What are the latest Moodle vulnerabilities in 2026?
04How do I secure a Moodle site?
05How often does Moodle release security updates?
06What if I cannot upgrade Moodle right now?
Stuck on an older Moodle version you cannot easily upgrade?
Run Cubite's free Moodle security audit to see exactly which advisories still affect your version, then book a 30-minute call to scope back-porting the critical patches to your release.
Related articles
Looking to learn more about Learning Management System, cubite lms, moodle, LMS Security and LMS Migration, Moodle, Cubite LMS, LMS Security? These related articles explore complementary topics, techniques, and strategies.
The 2026 Canvas Data Breach: A Timeline and What It Means for LMS Security
In the first half of 2026, one incident at Instructure generated roughly 58% of every US data-breach notice. Here is a sourced timeline of the Canvas breach, the multi-tenant root cause behind it, and what it changes about how you choose and host an LMS.
Moodle vs LearnDash: The Honest 2026 Comparison
WordPress LMS Security in 2026: Every Major Plugin Shipped a Serious Flaw
Across 2026, researchers disclosed fresh SQL injection and data-exposure flaws in all four leading WordPress LMS plugins. Here is what each one exposes, why the plugin-stack model keeps producing them, and how to lower your risk.
Compliance Training LMS: Verifiable Certificates and Audit-Ready Records
Regulators do not accept "we think everyone was trained." A compliance training LMS turns mandatory training into verified completions, verifiable certificates, tracked expiry dates, and records you can hand an auditor without a scramble.
HIPAA Training LMS: The Records an Audit Actually Tests
HIPAA training is easy to deliver and hard to prove. Here is what a HIPAA training LMS must actually record: per-person, timestamped, role-based, and kept for six years.
How many Moodle sites run an unsupported release? (monthly count)
A monthly count from moodle.org's own registration chart, with the method and its limits.