Description

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's order_by property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-01T05:17:10.283Z",
  "pubdate": "2026-09-01T05:17:10.283Z",
  "executiveSummary": "LearnPress plugin versions up to and including 4.4.4 are susceptible to an authenticated SQL injection vulnerability.\nThe flaw resides in the export_order_csv AJAX action, where the 'orderby' parameter is insufficiently sanitized before being processed by the database layer.\nThis vulnerability allows an attacker with administrator-level privileges to manipulate SQL queries by injecting arbitrary code into the ORDER BY clause.\nSuccessful exploitation can lead to unauthorized access to sensitive database information, potentially compromising the integrity and confidentiality of the WordPress installation.\nThe issue stems from a failure to validate user input against a strict whitelist and an absence of proper SQL query preparation within the relevant backend logic.\nThis vulnerability is restricted to authenticated users with high-level administrative permissions, but poses a significant security risk by enabling data exfiltration via malicious SQL constructs.",
  "technicalDetails": "The root cause of this vulnerability is improper handling of user-supplied data within the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions of the LearnPress plugin.\nSpecifically, the 'orderby' parameter passed to the export_order_csv AJAX action is not subjected to adequate validation or sanitization. While the plugin attempts to normalize the input, it only performs checks for the literal values 'date' and 'title'. Any other string provided by an attacker is passed directly to the order_by property without verification.\nThis unsanitized input is subsequently concatenated directly into the SQL ORDER BY clause. Because the application fails to use $wpdb->prepare() or implement an identifier whitelist for this parameter, the database engine executes the concatenated string as part of the query structure.\nThe attack flow requires an attacker to possess administrator-level authentication. The attacker initiates an AJAX request to the export_order_csv action, including a crafted payload in the 'orderby' parameter. By injecting malicious SQL syntax—such as subqueries or UNION-based operations—the attacker can force the database to return unintended results or leak information from other tables within the database.\nThe vulnerable code paths reside within the plugin's order processing logic, which fails to restrict input to authorized SQL identifiers. Without proper preparation or sanitization of these identifiers, the system is susceptible to blind or time-based SQL injection techniques, allowing for the extraction of sensitive database content.\nThe impact is significant, as administrative access is often a high-value target; once an attacker has secured this level of access, the ability to execute arbitrary SQL queries allows for database enumeration, potential credential theft, and total compromise of the application's data layer."
}