CVE-2025-62394: Moodle

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information.

Affected products

• Moodle Moodle: from 4.5.0, before 4.5.7 (fixed in 4.5.7); from 5.0.0, before 5.0.3 (fixed in 5.0.3)

Published 2025-10-23. Last modified 2026-06-17.