LearnPress WordPress Plugin CVE-2024-8522

Only prerequisite is that the target WordPress site has LearnPress ≤ 4.2.7 installed and active, with the WordPress REST API reachable from the attacker (default WordPress configuration). No authentication, no user interaction, no specific LearnPress course-publishing state, and no non-default settings are required - the vulnerable /wp-json/learnpress/v1/courses endpoint is exposed by the plugin on activation. Limiting factors are minimal: only sites that block /wp-json/* at the edge, force authentication on the REST API via a security plugin, or have already upgraded past 4.2.7 are not exploitable.

All signals point to high real-world priority: CVSS 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H indicates network-reachable, low-complexity, unauthenticated exploitation with scope change and full CIA impact; EPSS at 88.05% (99th percentile) reflects very high probability of exploitation in the next 30 days; publicly available POC further lowers the bar for opportunistic attackers scanning WordPress sites. The vulnerability is not currently listed in CISA KEV, so 'confirmed actively exploited' cannot be asserted - however, the combination of mass-deployed WordPress plugin, unauthenticated SQLi, and public POC makes opportunistic mass-scanning highly plausible. A minor caveat: the CVSS vector lists S:C (scope changed) and A:H, while the description characterizes the primary impact as data extraction (confidentiality); the integrity/availability scoring may be aspirational rather than demonstrated, but this does not meaningfully reduce defender urgency.

An attacker scanning the internet for WordPress sites running LearnPress sends an unauthenticated HTTP GET to https://victim/wp-json/learnpress/v1/courses with a malicious payload in the c_only_fields query parameter - for example a UNION SELECT that joins to wp_users - and receives the database response inline in the JSON body, extracting admin password hashes and session/email data. Because publicly available exploit code exists and no authentication or user interaction is required, this attack is trivially automatable across the LearnPress install base.