Unauthenticated SQL Injection Vulnerability in LearnPress WordPress LMS Plugin

CVE-2024-4434

Summary

The LearnPress – WordPress LMS Plugin is affected by a time-based SQL Injection vulnerability that exploits the ‘term_id’ parameter present in versions up to 4.2.6.5. Insufficient escaping of user-supplied data and inadequate preparation of the existing SQL query allow unauthenticated attackers to inject additional SQL commands. This vulnerability can be leveraged to manipulate database queries, enabling attackers to extract sensitive information from the database, compromising the security of WordPress installations utilizing this plugin.

References