PT-2021-16382 · WordPress · Learnpress

Jrxnm + 1 · Published 2021-12-13 · Updated 2021-12-16 · CVE-2021-24951

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: LearnPress WordPress plugin versions prior to 4.1.4

Description: The issue arises from the lack of sanitization, validation, and escaping of the id parameter in SQL statements when duplicating courses, lessons, quizzes, or questions. This leads to SQL injection issues.

Recommendations: For versions prior to 4.1.4, update to version 4.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the course/lesson/quiz/question duplication feature until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24951

Affected Products

Learnpress

References · 4

• 🔥 https://wpscan.com/vulnerability/0a16ddc5-5ab9-4a8f-86b5-41edcbeafc50 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24951 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24951 · Vendor Advisory
• https://t.me/cibsecurity/33819 · Telegram Post