Vulnerability Found In Moodle 3.6.3, Earlier Versions (Update With Moodle HQ Reply)
Updated on May 17th, 2019. Currently the vulnerability has been deemed as “Rejected,” meaning it’s not really an issue. Read a response from Moodle HQ with details at the bottom.