CVE-2023-6567

CRITICALNuclei

LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-6567 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 8, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 6, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

Browse thimpress / LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

Default status: unaffected

CVE ListThrough 4.2.5.7affected

learnpress

Browse thimpress / learnpress
VulnCheckVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHubmimiloveexe/CVE-2023-6567-pocRepository PoCby mimiloveexe0Not analyzed1 file

885 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHLearnPress <= 4.2.5.7 - SQL InjectionCVSS 7.5

The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'order_by' parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Impact

Unauthenticated attackers can execute time-based SQL injection through the order_by parameter to extract the complete WordPress database including user credentials and course data.

Remediation

Fixed in version 4.2.5.8

WeaknessesCWE-89
Authorsiamnoooob, rootxharsh, pdresearch
Template tagstime-based-sqliwpscancvecve2023wpwp-pluginwordpresslearnpresssqlithimpressvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/learnpress
FOFA: body=/wp-content/plugins/learnpress
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/learnpress/learnpress-4257-unauthenticated-sql-injection-via-order-by https://wpscan.com/vulnerability/c5110450-3b4e-4100-8db4-0d7f5d43c12f/ https://nvd.nist.gov/vuln/detail/CVE-2023-6567 https://plugins.trac.wordpress.org/changeset/3013957/learnpress https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab578cd-3a0b-43d3-aaa7-0a01f431a4e2?source=cve

Source: ProjectDiscovery

References

3