CVE-2024-8522

🗓️ 12 Sep 2024 08:30:46Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 217 Views🌐 WEB

LearnPress WordPress LMS Plugin SQL Injectio

Reporter	Title	Published	Views	Family All 21
0day.today	WordPress LMS 4.2.7 SQL Injection Vulnerability	23 Sep 202400:00	–	zdt
GithubExploit	Exploit for SQL Injection in Thimpress Learnpress	19 Sep 202407:04	–	githubexploit
BDU FSTEC	The vulnerability of the ‘c_only_fields’ parameter in the REST API endpoint /wp-json/learnpress/v1/courses of the LearnPress plugin for the WordPress content management system allows a hacker to execute arbitrary SQL code.	18 Feb 202500:00	–	bdu_fstec
Circl	CVE-2024-8522	12 Sep 202410:08	–	circl
CNNVD	WordPress plugin LearnPress SQL注入漏洞	12 Sep 202400:00	–	cnnvd
Cvelist	CVE-2024-8522 LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'	12 Sep 202408:30	–	cvelist
Exploit DB	LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection	11 Apr 202500:00	–	exploitdb
Metasploit	WordPress LearnPress Unauthenticated SQLi (CVE-2024-8522, CVE-2024-8529)	17 Oct 202418:54	–	metasploit
Nuclei	LearnPress < 4.2.7.1 - SQL Injection	21 Jul 202603:59	–	nuclei
NVD	CVE-2024-8522	12 Sep 202409:15	–	nvd

NVD

Vulners

Vulnrichment

Node

thimpress learnpressRange<4.2.7.1wordpress

[
  {
    "vendor": "thimpress",
    "product": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.2.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3148560/learnpress/tags/4.2.7.1/inc/jwt/rest-api/version1/class-lp-rest-courses-v1-controller.php
plugins	www.plugins.trac.wordpress.org/browser/learnpress/trunk/inc/jwt/rest-api/version1/class-lp-rest-courses-v1-controller.php
abrahack	www.abrahack.com/posts/learnpress-sqli/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e495507d-7eac-4f38-ab6f-b8f0809b2be4

Parameter	Position	Path	Description	CWE
c_only_fields	query param	wp-json/learnpress/v1/courses	SQL injection via c_only_fields parameter in LearnPress courses REST API endpoint allowing unauthenticated SQLi	CWE-89

17 Jun 2026 08:22Current

8.8High risk

Vulners AI Score8.8

CVSS 3.17.5 - 10

EPSS0.62882

SSVC

CWE-89

In Wild