CVE-2026-77823

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.5

Description An issue exists in the LearnPress plugin for WordPress where authenticated attackers with administrator-level access and above can perform SQL Injection. This occurs via the 'orderby' parameter of the 'export order csv' AJAX action. The flaw is caused by insufficient escaping of user-supplied parameters and a lack of preparation in the LP Order::handle params query list orders() and DataBase::execute() functions. While the values 'date' and 'title' are normalized, other attacker-controlled strings are assigned directly to the filter's order by property and concatenated into the ORDER BY clause without using $wpdb->prepare() or an identifier whitelist. This allows the execution of additional SQL queries to extract sensitive information from the database.

Recommendations Update LearnPress to version 4.4.5 or later. As a temporary mitigation, restrict access to the 'export order csv' AJAX action or avoid using the orderby parameter until the update is applied.