This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Unauthenticated SQL Injection in LearnPress REST API. π₯ **Consequences**: Attackers can extract sensitive DB data, create admin accounts, and gain full system control.β¦
π‘οΈ **CWE-89**: SQL Injection. π **Root Cause**: Insufficient escaping of user-supplied parameters (`c_only_fields`) and lack of prepared statements in existing SQL queries within the REST API endpoint.
Q3Who is affected? (Versions/Components)
π’ **Vendor**: ThimPress. π¦ **Product**: LearnPress β WordPress LMS Plugin. π **Affected**: Versions **4.2.7 and earlier**. π **Platform**: WordPress sites using this plugin.
Q4What can hackers do? (Privileges/Data)
π΅οΈ **Privileges**: Unauthenticated access required. π **Data**: Extract sensitive database info. π **Action**: Create new admin users via SQLi, leading to full website compromise and system access.
Q5Is exploitation threshold high? (Auth/Config)
β‘ **Threshold**: LOW. π« **Auth**: None required (Unauthenticated). π **Config**: Remote exploitation via REST API (`/wp-json/learnpress/v1/courses`). Easy to exploit for anyone.
Q6Is there a public Exp? (PoC/Wild Exploitation)
β **Yes**. Public POCs available on GitHub (e.g., `realbotnet`, `Avento`). π **Details**: Exploits `c_only_fields` parameter. Nuclei templates also exist for automated scanning. CVSS Score: 10.0.
Q7How to self-check? (Features/Scanning)
π **Check**: Scan for LearnPress plugin version β€ 4.2.7. π§ͺ **Test**: Target `/wp-json/learnpress/v1/courses` with SQLi payloads in `c_only_fields`.β¦
π§ **Fix**: Upgrade to version **4.2.7.1** or later. π **Patch**: Official changeset 3148560 addresses the escaping and query preparation issues in `class-lp-rest-courses-v1-controller.php`.
Q9What if no patch? (Workaround)
π§ **Workaround**: If patching is delayed, restrict REST API access via WAF rules. π **Block**: Filter malicious payloads targeting `c_only_fields` in the LearnPress REST endpoint. Disable plugin if not in use.
Q10Is it urgent? (Priority Suggestion)
π₯ **Priority**: CRITICAL. π¨ **Urgency**: Immediate action required. CVSS 10.0 + Unauthenticated + Public POCs = High risk of active exploitation. Patch immediately to prevent data breach and admin takeover.