CVE-2024-8522

CVE-2024-8522 is a critical SQL Injection vulnerability affecting the LearnPress – WordPress LMS Plugin, versions up to and including 4.2.7. Unauthenticated attackers can exploit this flaw via the '/wp-json/learnpress/v1/courses' REST API endpoint by manipulating the 'c_only_fields' parameter. This allows for the extraction of sensitive database information due to insufficient input sanitization and improper SQL query preparation. Rated with a CVSS score of 7.5 (High), this vulnerability is easily exploitable over the network with low attack complexity, requiring no user interaction or privileges. The primary impact is a high risk of data compromise (confidentiality), with no impact on integrity or availability. Exploitation is highly probable, with a FAUCET Risk Score of 100/100 and an EPSS score indicating it's more exploitable than 99.48% of all CVEs. Publicly available exploit code exists, including Metasploit modules and Nuclei templates, and it has been documented on ExploitDB. Despite the high exploitability, there is currently no evidence of active exploitation in the wild, nor significant community discussion or media coverage.