Executive brief
LearnPress is a popular learning management system plugin for WordPress used by educational websites to manage courses and student orders. The plugin contains a SQL injection vulnerability in its order export feature that allows authenticated administrators to inject malicious SQL commands, potentially exposing sensitive student and order information stored in the database.
Technical details
The vulnerability is a SQL injection (SQLi) flaw in the export_order_csv AJAX action, specifically in the 'orderby' parameter. The vulnerable code is located in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions, which fail to properly escape or parameterize user-supplied input. While the code attempts to normalize literal values 'date' and 'title', all other attacker-controlled strings are directly concatenated into the ORDER BY clause without using $wpdb->prepare() or an identifier whitelist. The vulnerability requires authenticated access with administrator-level privileges. An attacker can leverage this to append arbitrary SQL queries and extract sensitive data from the WordPress database. Patches are available in versions after 4.4.4.
Affected products
- LearnPress LearnPress up to and including 4.4.4
Timeline
- 2026-09-01: disclosed