Description
login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.
Remediation
References
Related Vulnerabilities
WordPress Plugin SP Project & Document Manager Arbitrary File Upload (4.22)
LimeSurvey Deserialization of Untrusted Data Vulnerability (CVE-2025-56422)
WordPress Plugin Quiz Maker Multiple SQL Injection Vulnerabilities (6.2.0.8)
MySQL CVE-2018-3279 Vulnerability (CVE-2018-3279)
WebLogic Improper Access Control Vulnerability (CVE-2026-60343)