CVE-2024-4434
Published: 14 May 2024
Summary
CVE-2024-4434 is a critical-severity SQL Injection (CWE-89) vulnerability in Thimpress Learnpress. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2024-4434 is a time-based SQL injection issue in the LearnPress WordPress LMS Plugin for WordPress, present in versions up to and including 4.2.6.5. It arises in the plugin's database component from insufficient escaping of the user-supplied term_id parameter combined with a lack of prepared statements on existing SQL queries, corresponding to CWE-89 and carrying a CVSS 3.1 score of 9.8.
Unauthenticated attackers with network access can supply crafted input to the affected parameter, appending additional queries that extract sensitive data from the WordPress database without any authentication or user interaction required.
Public references, including the Wordfence threat intelligence entry and the plugin's Trac changeset, point to an available fix in a later release that addresses the query handling.
The associated EPSS score stands at a peak of 0.7709, indicating substantial exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44057
Vulnerability details
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation…
more
on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.