CVE-2020-6010

HIGH

LearnPress <3.2.6.7 - SQL Injection

Title source: llm

Description

LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection

Exploits (2)

exploitdb WORKING POC

by nhattruong · textwebappsphp

https://www.exploit-db.com/exploits/50137

View Code ZIP pw:eip

metasploit WORKING POC

by h00die, Omri Herscovici, Sagi Tzadik, nhattruong · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_learnpress_sqli.rb

View Code ZIP pw:eip

References (4)

[Release Notes] https://plugins.trac.wordpress.org/browser/learnpress/trunk/readme.txt?rev=2288975

[Exploit, Third Party Advisory] https://research.checkpoint.com/2020/e-learning-platforms-getting-schooled-multiple-vulnerabilities-in-wordpress-most-popular-learning-management-system-plugins/

[Release Notes] https://wordpress.org/plugins/learnpress/#developers

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/163536/WordPress-LearnPress-SQL-Injection.html

Scores

CVSS v3 8.8

EPSS 0.4550

EPSS Percentile 97.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

thimpress/learnpress < 3.2.6.7

Published Apr 30, 2020

Tracked Since Feb 18, 2026