CVE-2021-21809: A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10.

Security readout for executives and security teams

CVE-2021-21809 is a high-severity command execution issue in Moodle 3.10's default legacy spellchecker plugin. It matters because successful exploitation can let an administrator-level attacker run commands through crafted HTTP requests. The required administrator privileges materially reduce broad exposure, but compromised or malicious admin accounts could turn this into server-level impact. Organizations running Moodle 3.10 are the relevant exposure population. Risk is highest where Moodle is internet-facing and administrator accounts are numerous, weakly protected, or already compromised. The bundle does not identify other affected Moodle versions. Treat this as high priority for any Moodle 3.10 environment, especially internet-facing learning portals. It is not described as unauthenticated, but administrator compromise could escalate into command execution on the hosting system. Prioritize inventory, admin-account hardening, and vendor-confirmed remediation. Mitigation focus: Inventory Moodle instances and identify any running Moodle 3.10.; Review Moodle vendor guidance for the supported fix or configuration change.; Restrict administrator access to trusted users and networks where possible..

Prepared

May 23, 2026, 09:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.