CVE-2026-77823
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's order_by property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Risk Assessment
An attacker with administrator privileges can extract sensitive data from the database, such as passwords, user data, or other confidential information.
Recommendation
Update the LearnPress plugin to the latest version that includes a fix, or apply temporary measures such as disabling the export functionality.
Other vulnerabilities in LearnPress
See all- CVE-2026-86449Medium
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes. Unauthenticated attackers can list courses that are not published, including draft, pending, private, scheduled and trashed ones.
- CVE-2026-86448Low
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file. Unauthenticated attackers who can determine its identifier can download customer names, purchases, amounts and guest email addresses.
- CVE-2026-86447Medium
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools. Unauthenticated attackers can list every enrolled student's display name and user identifier against the course they are enrolled on, and recover their email addresses through the same handler's search filter.
- CVE-2026-86445Medium
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers. Unauthenticated attackers can retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
- CVE-2026-86444High
The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page. Unauthenticated attackers can execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block mode are affected.
- CVE-2026-12230Medium
The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to and including 4.3.9.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-82024Medium
LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary JavaScript through the answer title parameter, which is rendered through an unescaped HTML sink to execute in the browsers of any user who views the affected quiz question, including students, other instructors, and administrators.
- CVE-2026-82023Medium
The LearnPress WordPress plugin before version 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors. A missing ownership check on the answer insertion path lets attackers supply arbitrary question identifiers and bypass instructor-boundary restrictions.
- CVE-2026-75982Medium
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to and including 4.4.4 via the learnpress_create_page AJAX action. Attackers with Editor-level access can update arbitrary options, such as users_can_register or active_plugins, potentially enabling public registration or breaking the site.
- CVE-2026-12976Medium
The LearnPress WordPress plugin before version 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.
Original NVD description (English source)
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's order_by property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS