Furkan K

**Name of the Vulnerable Software and Affected Versions** LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress versions up to, and including, 7.7.5 **Description** The issue is related to blind SQL Injection via the `order` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. **Recommendations** For versions up to, and including, 7.7.5, consider disabling the `order` parameter in the affected API endpoint until a patch is available. Restrict access to the database to minimize the risk of exploitation. As a temporary workaround, limit administrator-level access to trusted users only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.