by Michael Hawkins. An SQL injection risk was identified in the "external database" authentication plugin (auth_db). Note: This only affected sites with the auth_db authentication plugin enabled. Severity/Risk: Serious Versions affected: 5.1 to 5.1.3, 5.0 to 5.0.6, 4.5 to 4.5.10 and earlier unsupported versions Versions fixed: 5.1.4, 5.0.7 and 4.5.11 Reported by: Melvinsh CVE identifier: CVE-2026-7274 Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88138 Tracker issue: MDL-88138 SQL injection risk in external database authentication plugin