This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: Unauthenticated SQL Injection (SQLi) in LearnPress plugin. 💥 **Consequences**: Attackers can extract sensitive database info, compromising data integrity & confidentiality.
Q2Root Cause? (CWE/Flaw)
🛡️ **Root Cause**: CWE-89 (SQL Injection). ❌ **Flaw**: Insufficient escaping of user-supplied parameters & lack of prepared statements in SQL queries.
🕵️ **Privileges**: Unauthenticated (No login needed). 📊 **Data**: Extract sensitive info from the database via the REST API endpoint.
Q5Is exploitation threshold high? (Auth/Config)
📉 **Threshold**: **LOW**. 🚪 **Auth**: None required. ⚙️ **Config**: Exploitable via standard REST API (`/wp-json/lp/v1/courses/archive-course`).
Q6Is there a public Exp? (PoC/Wild Exploitation)
🔓 **Exploit**: **YES**. 📂 **PoC**: Available on GitHub (RandomRobbieBF) & Nuclei templates. 🌍 **Wild Exploitation**: Likely due to low barrier.
Q7How to self-check? (Features/Scanning)
🔍 **Check**: Scan for LearnPress plugin version ≤ 4.2.7. 🧪 **Test**: Probe `c_fields` parameter in the archive-course REST API endpoint.
Q8Is it fixed officially? (Patch/Mitigation)
✅ **Fixed**: **YES**. 🔄 **Patch**: Upgrade to version **4.2.7.1** or later. 📝 **Ref**: WordPress Trac changeset confirms fix.
Q9What if no patch? (Workaround)
🚧 **Workaround**: If unpatched, restrict access to `/wp-json/lp/v1/courses/archive-course` via WAF or firewall rules. 🛑 Block unauthenticated API calls.
Q10Is it urgent? (Priority Suggestion)
🔥 **Urgency**: **HIGH**. 🚨 **Priority**: Critical. CVSS Score implies High Impact. Immediate patching or mitigation required to prevent data breach.