Vulnerability record · CVE-2024-8522 · published 12 September 2024
CVE-2024-8522: LearnPress WordPress LMS Plugin Unauthenticated SQL Injection
Thimpress · Learnpress
The LearnPress WordPress LMS plugin fails to escape the 'c_only_fields' parameter on the /wp-json/learnpress/v1/courses REST API endpoint, allowing SQL injection in all versions up to and including 4.2.7. Because the endpoint is reachable without authentication, any remote attacker can inject SQL into existing queries and read sensitive data from the WordPress database.
Description
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated SQL injection with high confidentiality impact and a very high EPSS score, though no KEV listing or known ransomware use is recorded.
What it is
The LearnPress WordPress LMS plugin fails to escape the 'c_only_fields' parameter on the /wp-json/learnpress/v1/courses REST API endpoint, allowing SQL injection in all versions up to and including 4.2.7. Because the endpoint is reachable without authentication, any remote attacker can inject SQL into existing queries and read sensitive data from the WordPress database.
Impact
An attacker can extract arbitrary data from the underlying database, including user credentials, email addresses, and other site content. The CVSS vector shows high confidentiality impact with no integrity or availability impact.
Attack surface
Reached over the network via the unauthenticated REST API endpoint /wp-json/learnpress/v1/courses, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
No CISA KEV listing and no ransomware association are recorded, but EPSS is 0.62882 (99.16th percentile), indicating a high likelihood of exploitation activity; a public advisory and patch reference exist.
What to do
- Update LearnPress to version 4.2.7.1 or later, which contains the patch referenced in the changelog.
- If immediate patching is not possible, restrict or block access to the /wp-json/learnpress/v1/courses REST endpoint at the web server or WAF.
- Apply a WAF rule to detect and block SQL injection patterns in the c_only_fields parameter.
- Audit the WordPress database and user accounts for signs of unauthorized data access after exposure.
Detection
- Monitor web server and WAF logs for requests to /wp-json/learnpress/v1/courses containing SQL keywords or unusual characters in the c_only_fields parameter.
- Alert on high volumes of requests to the LearnPress REST API from single IPs or with anomalous query strings.
- Review database query logs for unexpected UNION, SELECT, or stacked query patterns originating from the web application.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-8522 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-8522), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
