WordPress LearnPress plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' vulnerability

🗓️ 12 Sep 2024 06:38:13Reported by abrahackType

patchstack

patchstack🔗 patchstack.com👁 10 Views

Unauthenticated SQL injection in LearnPress plugin for WordPress versions up to 4.2.7 via c_only_fields.

Reporter	Title	Published	Views	Family All 21
0day.today	WordPress LMS 4.2.7 SQL Injection Vulnerability	23 Sep 202400:00	–	zdt
GithubExploit	Exploit for SQL Injection in Thimpress Learnpress	19 Sep 202407:04	–	githubexploit
BDU FSTEC	The vulnerability of the ‘c_only_fields’ parameter in the REST API endpoint /wp-json/learnpress/v1/courses of the LearnPress plugin for the WordPress content management system allows a hacker to execute arbitrary SQL code.	18 Feb 202500:00	–	bdu_fstec
Circl	CVE-2024-8522	12 Sep 202410:08	–	circl
CNNVD	WordPress plugin LearnPress SQL注入漏洞	12 Sep 202400:00	–	cnnvd
CVE	CVE-2024-8522	12 Sep 202408:30	–	cve
Cvelist	CVE-2024-8522 LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'	12 Sep 202408:30	–	cvelist
Exploit DB	LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection	11 Apr 202500:00	–	exploitdb
Metasploit	WordPress LearnPress Unauthenticated SQLi (CVE-2024-8522, CVE-2024-8529)	17 Oct 202418:54	–	metasploit
Nuclei	LearnPress < 4.2.7.1 - SQL Injection	16 Jul 202609:41	–	nuclei

Vulners

Node

wordpress learnpressRange≤4.2.7

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/learnpress/learnpress-wordpress-lms-plugin-427-unauthenticated-sql-injection-via-c-only-fields

12 Sep 2024 06:38Current

8.1High risk

Vulners AI Score8.1

CVSS 3.17.5 - 10

EPSS0.63134

SSVC

WordPress LearnPress sql injection unauthenticated c_only_fields vulnerability