LearnPress WordPress Plugin CVE-2024-8522
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to inject arbitrary SQL via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST endpoint, enabling extraction of sensitive database contents including user credentials and PII. Publicly available exploit code exists, and the EPSS score of 88.05% (99th percentile) indicates very high real-world exploitation likelihood, though the issue is not currently listed in CISA KEV.
Technical ContextAI
LearnPress (vendor: ThimPress, CPE cpe:2.3:a:thimpress:learnpress) is one of the most widely installed Learning Management System plugins for WordPress, exposing course management functionality through WordPress REST API routes under /wp-json/learnpress/v1/. The flaw is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) caused by the 'c_only_fields' query parameter being concatenated into a SQL statement without proper escaping and without use of $wpdb->prepare() placeholders. Because the vulnerable endpoint is reachable without authentication and the SQL query is appended (stacked/UNION-style injection per the description), the attacker can pivot from a public course-listing endpoint into arbitrary read access against the WordPress database (wp_users, wp_usermeta, etc.).
RemediationAI
Patch available per vendor advisory - upgrade LearnPress to a fixed release greater than 4.2.7 via the WordPress plugin updater or by downloading the latest version from https://wordpress.org/plugins/learnpress/; review the Wordfence advisory at wordfence.com for the precise patched version and disclosure timeline. If immediate patching is not possible, compensating controls include blocking or restricting access to the /wp-json/learnpress/v1/courses endpoint at the WAF or reverse-proxy layer (trade-off: legitimate course listing API consumers and the LearnPress frontend course browser may break), deploying a WordPress WAF rule that filters the 'c_only_fields' parameter for SQL metacharacters such as UNION, SELECT, single quotes, and parentheses (trade-off: may produce false positives on legitimate field names), or temporarily deactivating the LearnPress plugin until upgrade (trade-off: takes the entire LMS offline). Generic 'disable REST API' is not recommended as it breaks WordPress core functionality.
More from same product – last 7 days
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers t
Unauthenticated arbitrary file upload in the BookingPress Pro WordPress plugin (versions ≤5.6) enables remote code execu
Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthentic
Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and incl
Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and
Share
External POC / Exploit Code
Leaving vuln.today