CVE-2024-8522

LearnPress, a learning-management-system plugin for WordPress by ThimPress, contains a SQL injection flaw in the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint. The parameter is insufficiently escaped and the underlying SQL query is not properly prepared, so an attacker can append additional SQL queries to the existing one. Because the endpoint requires no authentication, any remote attacker who can reach the site's REST API can send a crafted request and read sensitive information from the WordPress database, such as user and site data. All sites running any version of LearnPress up to and including 4.2.7 are affected, and the REST API is exposed by default on standard WordPress installations. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the high EPSS score (62.9%, 99th percentile) indicates a substantial likelihood of exploitation in the next 30 days.

What to do: Update LearnPress to the latest release (any version after 4.2.7). Sites that cannot update immediately should protect or restrict access to the /wp-json/learnpress/v1/courses route, e.g., via WAF rules that block SQL metacharacters in the c_only_fields parameter, and review logs for suspicious unauthenticated requests to that endpoint.