What is the CVSS score of CVE-2024-8522?

CVE-2024-8522 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 88.1%.

Which versions of LearnPress WordPress Plugin are affected by CVE-2024-8522?

LearnPress LMS plugin for WordPress (versions 4.2.7 and earlier) contains a critical SQL injection vulnerability allowing unauthenticated attackers to extract sensitive database contents, including…. A patch is available.

Is there a public PoC exploit available for CVE-2024-8522?

Yes, a public proof-of-concept exploit is available for CVE-2024-8522. Prioritise patching immediately. EPSS: 88.1%.

How to fix or mitigate CVE-2024-8522?

24 hours: Inventory all WordPress installations and identify systems running LearnPress plugin version 4.2.7 or earlier. 7 days: Apply vendor patch to upgrade LearnPress to version 4.2.8 or later across all affected systems and verify successful deployment. 30 days: Conduct forensic analysis of database access logs during the vulnerability window, force password reset for all user accounts, and assess whether user data or credentials were accessed.

LearnPress WordPress Plugin CVE-2024-8522

CRITICAL

SQL Injection (CWE-89)

2024-09-12 security@wordfence.com

SQLi WordPress Learnpress

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 08, 2026 - 19:39 nvd

Patch available

PoC Detected

Apr 08, 2026 - 19:22 vuln.today

Public exploit code

CVE Published

Sep 12, 2024 - 09:15 nvd

CRITICAL 10.0

DescriptionCVE.org

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to inject arbitrary SQL via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST endpoint, enabling extraction of sensitive database contents including user credentials and PII. Publicly available exploit code exists, and the EPSS score of 88.05% (99th percentile) indicates very high real-world exploitation likelihood, though the issue is not currently listed in CISA KEV.

Technical ContextAI

LearnPress (vendor: ThimPress, CPE cpe:2.3:a:thimpress:learnpress) is one of the most widely installed Learning Management System plugins for WordPress, exposing course management functionality through WordPress REST API routes under /wp-json/learnpress/v1/. The flaw is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) caused by the 'c_only_fields' query parameter being concatenated into a SQL statement without proper escaping and without use of $wpdb->prepare() placeholders. Because the vulnerable endpoint is reachable without authentication and the SQL query is appended (stacked/UNION-style injection per the description), the attacker can pivot from a public course-listing endpoint into arbitrary read access against the WordPress database (wp_users, wp_usermeta, etc.).

RemediationAI

Patch available per vendor advisory - upgrade LearnPress to a fixed release greater than 4.2.7 via the WordPress plugin updater or by downloading the latest version from https://wordpress.org/plugins/learnpress/; review the Wordfence advisory at wordfence.com for the precise patched version and disclosure timeline. If immediate patching is not possible, compensating controls include blocking or restricting access to the /wp-json/learnpress/v1/courses endpoint at the WAF or reverse-proxy layer (trade-off: legitimate course listing API consumers and the LearnPress frontend course browser may break), deploying a WordPress WAF rule that filters the 'c_only_fields' parameter for SQL metacharacters such as UNION, SELECT, single quotes, and parentheses (trade-off: may produce false positives on legitimate field names), or temporarily deactivating the LearnPress plugin until upgrade (trade-off: takes the entire LMS offline). Generic 'disable REST API' is not recommended as it breaks WordPress core functionality.