CVE-2022-45808 — AI Deep Analysis Summary

🚨 **Essence**: Unauthenticated SQL Injection in LearnPress Plugin. 💥 **Consequences**: Attackers can manipulate database queries, leading to data theft or system compromise.…

🛡️ **Root Cause**: CWE-89 (SQL Injection). The plugin fails to sanitize/escape the `order_by` parameter before using it in SQL statements. 🐛 **Flaw**: Poor input validation on API endpoints.

📦 **Affected**: WordPress Plugin **LearnPress – WordPress LMS Plugin**. 📉 **Versions**: Version **4.1.7.3.2 and earlier** (specifically < 4.2.0). Vendor: ThimPress.

💀 **Attacker Actions**: Extract sensitive data (e.g., `user_pass` hashes), modify database content, or potentially execute arbitrary SQL commands.…

⚡ **Threshold**: **LOW**. No authentication required! 🚪 **Access**: Unauthenticated users can exploit this via the `/wp-json/lp/v1/courses/archive-course` endpoint. Very easy to trigger.

🔓 **Exploit Status**: **YES**. Public PoCs exist on GitHub (e.g., `sqlmap` scripts). 🌐 **Wild Exploitation**: Likely, given the ease of use with tools like sqlmap and Nuclei templates.

🔍 **Self-Check**: Scan for the specific endpoint `/wp-json/lp/v1/courses/archive-course`. Use Nuclei templates or sqlmap with `--level=5` to test the `order_by` parameter for time-based blind SQLi.…

🩹 **Fix Status**: **YES**. The vulnerability was fixed in version **4.2.0**. 📝 **Action**: Update the LearnPress plugin immediately to the latest version to patch the SQLi flaw.

🚧 **No Patch Workaround**: Disable the specific REST API endpoint if possible. Restrict access to `/wp-json/lp/v1/` via WAF rules.…

🔥 **Urgency**: **HIGH**. CVSS Score indicates Critical impact on Confidentiality. Unauthenticated access makes it extremely dangerous. 🚀 **Priority**: Patch immediately to prevent data breaches.