LearnPress patches multiple vulnerabilities

LearnPress, a WordPress LMS plugin, has released security updates to address multiple critical vulnerabilities that affected approximately 75,000 WordPress sites.

One of flaws is CVE-2022-47615; where an unauthenticated local file inclusion allows an attacker to view the contents of local files stored on the web server, potentially exposing credentials, authorization tokens, and API keys.

The flaw was discovered in a piece of code that handles API requests for the website located in the “list_courses” function, which does not validate certain variables ($template_pagination_path, $template_path, and $template_path_item) properly.

While CVE-2022-45808; is an unauthenticated SQL injection vulnerability that could allow an attacker to insert malicious code, potentially exposing sensitive information, modifying data, and executing arbitrary code. This flaw exists in a function that handles SQL queries for the website and does not properly sanitize and validate the “$filter” variable in the query parameters, allowing an attacker to insert malicious code into it.

CVE-2022-45820, the third vulnerability is an authenticated SQL injection vulnerability that could allow an attacker to insert malicious code, potentially resulting in sensitive information disclosure, data modification, and arbitrary code execution.

With the release of LearnPress version 4.2.0 on December 20, 2022, the issues which are rated critical were resolved. However, according to statistics, only about 25% of users have installed the update.

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web