What is the CVSS score of CVE-2024-4434?

CVE-2024-4434 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 77.1%.

Which versions of LearnPress WordPress Plugin are affected by CVE-2024-4434?

LearnPress LMS, a learning management plugin for WordPress, contains a critical SQL injection vulnerability (CVE-2024-4434, CVSS 9.8) affecting versions up to 4.2.6.5 that allows unauthenticated…

Is there a public PoC exploit available for CVE-2024-4434?

Yes, a public proof-of-concept exploit is available for CVE-2024-4434. Prioritise patching immediately. EPSS: 77.1%.

How to fix or mitigate CVE-2024-4434?

Within 24 hours: Audit all WordPress instances for LearnPress plugin installation and version; disable the plugin immediately if version 4.2.6.5 or earlier is detected and no patched version is available. Within 7 days: Contact LearnPress vendor for patch timeline; implement WAF/IDS rules to block SQL injection attempts on the affected parameter (term_id); conduct database access logs review for evidence of exploitation. Within 30 days: If patched version is released, deploy across all instances; if no patch timeline is provided by vendor, evaluate alternative LMS solutions and plan migration strategy.

LearnPress WordPress Plugin CVE-2024-4434

CRITICAL

SQL Injection (CWE-89)

2024-05-14 security@wordfence.com

SQLi WordPress Learnpress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Apr 08, 2026 - 17:18 vuln.today

Public exploit code

CVE Published

May 14, 2024 - 15:43 nvd

CRITICAL 9.8

DescriptionCVE.org

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenticated attackers to append arbitrary SQL to a backend query via the term_id parameter, enabling extraction of sensitive database contents such as user credentials and session data. Publicly available exploit code exists and the EPSS score of 77.09% (99th percentile) indicates a very high probability of opportunistic exploitation against exposed WordPress sites running this plugin.

Technical ContextAI

LearnPress is the ThimPress-developed Learning Management System plugin for WordPress, widely deployed by educational and e-commerce sites to deliver courses and quizzes. The flaw is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue in which the term_id request parameter is concatenated into a SQL statement without adequate escaping and without using prepared statements / parameterized queries via WordPress's $wpdb->prepare(). Because the underlying query is time-blind exploitable, the attacker uses SQL functions like SLEEP() to infer data one bit at a time, and the CPE cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:* confirms every LearnPress version up to and including 4.2.6.5 across all WordPress installations is in scope.

RemediationAI

Upgrade the LearnPress plugin to a version newer than 4.2.6.5 via the WordPress plugin updater or by downloading the latest release from wordpress.org/plugins/learnpress; consult the Wordfence advisory referenced under security@wordfence.com for the exact fixed version. If immediate patching is not possible, deploy a WAF rule (Wordfence, Sucuri, Cloudflare managed rules) to block requests containing SQL metacharacters or time-based payloads in the term_id parameter, restrict access to LearnPress AJAX and REST endpoints to authenticated users at the web-server layer, and temporarily deactivate the plugin if the LMS functionality is non-essential - note that WAF rules can produce false positives on legitimate course taxonomy IDs, and deactivation will break enrolled-student access to course content.