LearnPress, a WordPress LMS plugin, has released security updates to address multiple critical vulnerabilities that affected approximately 75,000 WordPress sites.
One of flaws is CVE-2022-47615; where an unauthenticated local file inclusion allows an attacker to view the contents of local files stored on the web server, potentially exposing credentials, authorization tokens, and API keys.
The flaw was discovered in a piece of code that handles API requests for the website located in the “list_courses” function, which does not validate certain variables ($template_pagination_path, $template_path, and $template_path_item) properly.
While CVE-2022-45808; is an unauthenticated SQL injection vulnerability that could allow an attacker to insert malicious code, potentially exposing sensitive information, modifying data, and executing arbitrary code. This flaw exists in a function that handles SQL queries for the website and does not properly sanitize and validate the “$filter” variable in the query parameters, allowing an attacker to insert malicious code into it.
CVE-2022-45820, the third vulnerability is an authenticated SQL injection vulnerability that could allow an attacker to insert malicious code, potentially resulting in sensitive information disclosure, data modification, and arbitrary code execution.
With the release of LearnPress version 4.2.0 on December 20, 2022, the issues which are rated critical were resolved. However, according to WordPress.org statistics, only about 25% of users have installed the update.
The sources for this piece include an article in BleepingComputer.