CVE-2023-6567: LearnPress WordPress plugin unauthenticated time-based SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable SQL injection with high confidentiality impact and a high EPSS score, though not listed in KEV.

What it is

The LearnPress plugin for WordPress is vulnerable to time-based SQL injection through the 'order_by' parameter in all versions up to and including 4.2.5.7. The user-supplied parameter is insufficiently escaped and the SQL query is not properly prepared, allowing additional SQL to be appended. This matters because it exposes the WordPress database to unauthenticated attackers.

Impact

An attacker can extract sensitive information from the database, including potentially user credentials and other stored data. The CVSS vector indicates high confidentiality impact with no integrity or availability impact.

Attack surface

The flaw is reachable over the network via the 'order_by' parameter, with no authentication and no user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any exposed WordPress site running an affected LearnPress version is a candidate target.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at 0.51394 (98.9th percentile), indicating elevated likelihood of exploitation activity. References are third-party advisories only and do not document in-the-wild exploitation.

What to do

• Update LearnPress to a version newer than 4.2.5.7, which contains the fix referenced in the plugin changeset.
• If immediate patching is not possible, disable or remove the LearnPress plugin until it can be updated.
• Deploy a web application firewall rule to block SQL injection patterns targeting the 'order_by' parameter.
• Restrict database account privileges used by WordPress to the minimum required.
• Monitor plugin advisories from Wordfence and the WordPress plugin repository for follow-up guidance.

Detection

• Review web server and WAF logs for requests containing SQL syntax or time-delay functions in the 'order_by' parameter.
• Look for unusually long response times or repeated requests to LearnPress endpoints that could indicate time-based blind SQL injection probing.
• Audit database query logs for unexpected SQL appended to LearnPress queries.
• Check for anomalous outbound or database access patterns consistent with data extraction.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.