LearnPress WordPress Plugin
CVE-2024-4434
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress sites running LearnPress ≤4.2.6.5
-
DeliverySend crafted term_id with time-based payload
-
ExploitConfirm blind SQLi via response delay
-
ExecutionIteratively exfiltrate wp_users hashes
-
PersistCrack admin credentials offline
-
ImpactAuthenticate to wp-admin and plant backdoor
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site with the LearnPress plugin (versions ≤ 4.2.6.5) installed and activated; the vulnerable term_id parameter is reachable without login, user interaction, or non-default settings. The only limiting factors are that the LearnPress plugin must be installed and active, the site must expose its standard frontend/AJAX surface to the attacker (no IP allowlist or maintenance mode), and the SQL injection is time-based blind, so extraction requires multiple requests and is slow against latency-sensitive or aggressively rate-limited targets. |
| Impact | All scoring signals align toward high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates a network-reachable, low-complexity attack requiring no authentication and no user interaction, with full confidentiality, integrity, and availability impact (9.8 critical). EPSS at 77.09% (99th percentile) is exceptionally high, indicating active scanning and exploitation likelihood, and a public POC further lowers the skill bar. The vulnerability is not currently listed in CISA KEV, so 'confirmed actively exploited' cannot be asserted, but the combination of public POC, high EPSS, WordPress's mass-target ecosystem, and unauthenticated reachability makes opportunistic mass exploitation realistic. One caveat: the description characterizes this as a data-extraction primitive (confidentiality), yet CVSS marks I:H and A:H, suggesting the integrity/availability ratings may be inflated relative to demonstrated impact - verify with Wordfence advisory before assuming write/destruction capability. |
| Exploit ScenarioDerived | An unauthenticated attacker scans the internet for WordPress sites with LearnPress installed and sends an HTTP request to a LearnPress endpoint with a crafted term_id parameter containing a time-based blind SQL injection payload (e.g., a UNION or conditional SLEEP). By measuring response delays, the attacker iteratively extracts the wp_users table, harvesting administrator password hashes and email addresses for offline cracking or credential-stuffing, leveraging the publicly available exploit code to automate the process across thousands of sites. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenticated attackers to append arbitrary SQL to a backend query via the term_id parameter, enabling extraction of sensitive database contents such as user credentials and session data. Publicly available exploit code exists and the EPSS score of 77.09% (99th percentile) indicates a very high probability of opportunistic exploitation against exposed WordPress sites running this plugin.
RemediationAI
Upgrade the LearnPress plugin to a version newer than 4.2.6.5 via the WordPress plugin updater or by downloading the latest release from wordpress.org/plugins/learnpress; consult the Wordfence advisory referenced under security@wordfence.com for the exact fixed version. If immediate patching is not possible, deploy a WAF rule (Wordfence, Sucuri, Cloudflare managed rules) to block requests containing SQL metacharacters or time-based payloads in the term_id parameter, restrict access to LearnPress AJAX and REST endpoints to authenticated users at the web-server layer, and temporarily deactivate the plugin if the LMS functionality is non-essential - note that WAF rules can produce false positives on legitimate course taxonomy IDs, and deactivation will break enrolled-student access to course content.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LearnPress is the ThimPress-developed Learning Management System plugin for WordPress, widely deployed by educational and e-commerce sites to deliver courses and quizzes. The flaw is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue in which the term_id request parameter is concatenated into a SQL statement without adequate escaping and without using prepared statements / parameterized queries via WordPress's $wpdb->prepare(). Because the underlying query is time-blind exploitable, the attacker uses SQL functions like SLEEP() to infer data one bit at a time, and the CPE cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:* confirms every LearnPress version up to and including 4.2.6.5 across all WordPress installations is in scope.
Know when Learnpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Executive ViewAI
LearnPress LMS, a learning management plugin for WordPress, contains a critical SQL injection vulnerability (CVE-2024-4434, CVSS 9.8) affecting versions up to 4.2.6.5 that allows unauthenticated attackers to extract database contents including user credentials and session tokens. Any organization operating WordPress sites with this plugin installed is exposed to unauthorized database access and credential compromise; the 77th percentile EPSS score and publicly available exploit code indicate active targeting risk.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable LearnPress plugin entirely until patched version available; (2) Implement Web Application Firewall (WAF) rules to block SQL injection payloads targeting the term_id parameter; (3) Restrict WordPress administrative database access to minimal required accounts and monitor database query logs for anomalous activity; (4) Implement network segmentation to limit database exposure if compromise occurs; (5) Force password reset for all user accounts and invalidate active sessions following detection of any exploitation evidence.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
More in Learnpress
View allSQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to injec
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versio
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter o
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in
Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authent
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection. Rated high severity (CVS
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticat
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio
Reflected cross-site scripting in the LearnPress WordPress plugin before 4.4.7 allows unauthenticated attackers to injec
Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file t
GitHub PoC
Exploit-DB