LearnPress WordPress Plugin CVE-2024-4434
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenticated attackers to append arbitrary SQL to a backend query via the term_id parameter, enabling extraction of sensitive database contents such as user credentials and session data. Publicly available exploit code exists and the EPSS score of 77.09% (99th percentile) indicates a very high probability of opportunistic exploitation against exposed WordPress sites running this plugin.
Technical ContextAI
LearnPress is the ThimPress-developed Learning Management System plugin for WordPress, widely deployed by educational and e-commerce sites to deliver courses and quizzes. The flaw is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue in which the term_id request parameter is concatenated into a SQL statement without adequate escaping and without using prepared statements / parameterized queries via WordPress's $wpdb->prepare(). Because the underlying query is time-blind exploitable, the attacker uses SQL functions like SLEEP() to infer data one bit at a time, and the CPE cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:* confirms every LearnPress version up to and including 4.2.6.5 across all WordPress installations is in scope.
RemediationAI
Upgrade the LearnPress plugin to a version newer than 4.2.6.5 via the WordPress plugin updater or by downloading the latest release from wordpress.org/plugins/learnpress; consult the Wordfence advisory referenced under security@wordfence.com for the exact fixed version. If immediate patching is not possible, deploy a WAF rule (Wordfence, Sucuri, Cloudflare managed rules) to block requests containing SQL metacharacters or time-based payloads in the term_id parameter, restrict access to LearnPress AJAX and REST endpoints to authenticated users at the web-server layer, and temporarily deactivate the plugin if the LMS functionality is non-essential - note that WAF rules can produce false positives on legitimate course taxonomy IDs, and deactivation will break enrolled-student access to course content.
More from same product – last 7 days
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers t
Unauthenticated arbitrary file upload in the BookingPress Pro WordPress plugin (versions ≤5.6) enables remote code execu
Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthentic
Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and incl
Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and
Share
External POC / Exploit Code
Leaving vuln.today