Vulnerability in LearnPress Allows Attackers to Extract Sensitive Information from Database
CVE-2024-7548
6.5MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 8 August 2024
What is CVE-2024-7548?
The LearnPress LMS Plugin for WordPress is affected by a time-based SQL Injection vulnerability due to insufficient escaping of user-supplied parameters, specifically the 'order' parameter. This vulnerability permits authenticated attackers with Contributor-level access and above to inject additional SQL queries into existing queries. Consequently, this exploitation can lead to the unauthorized extraction of sensitive information from the database, posing a significant risk to the integrity and confidentiality of user data.
Affected Version(s)
LearnPress – WordPress LMS Plugin * <= 4.2.6.9.3