LearnPress EUVD-2026-68979

Exploitation requires an authenticated session with WordPress administrator-level privileges or higher (confirmed by CVSS PR:H). The attack targets the export_order_csv AJAX action, which is gated behind this privilege check - subscriber, contributor, or editor roles cannot reach the vulnerable code path. The 'orderby' parameter must contain a value other than the literal strings 'date' or 'title' to bypass the partial normalization logic. The target installation must be running LearnPress version 4.4.4 or earlier. Attack vector is network (AV:N), meaning exploitation is possible remotely once the attacker has obtained valid administrator credentials. No special server-side configuration or non-default feature flag is required beyond having the plugin installed and active.

The CVSS 4.9 (Medium) score with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N accurately represents the real-world risk profile. The high privilege requirement (PR:H - WordPress administrator) is the dominant mitigating factor; this vulnerability is entirely unreachable by unauthenticated or subscriber/editor-level users. While the confidentiality impact is rated High - meaning full database read is theoretically possible - WordPress administrators already possess direct database access through native tooling (phpMyAdmin, WP-CLI, wp-admin export), which substantially reduces the marginal risk this flaw introduces. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. KEV status is not confirmed, and no public POC has been noted. This should be treated as a low-priority patch for most organizations unless administrator accounts are shared across untrusted parties or the installation is a multi-tenant WordPress environment.

An attacker with WordPress administrator credentials sends a crafted POST request to the admin-ajax.php endpoint invoking the export_order_csv action, with the 'orderby' parameter set to a SQL UNION or time-based blind injection payload. Because the value bypasses the partial whitelist and is concatenated directly into the ORDER BY clause in DataBase::execute(), the injected SQL executes against the WordPress database, enabling retrieval of password hashes, user emails, session tokens, or order metadata. No public exploit code has been identified, though ORDER BY injection techniques are well-documented and the vulnerability is mechanically straightforward to exploit once authenticated.