CVE-2026-77823: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

The LearnPress plugin for WordPress is vulnerable to SQL Injection through the 'orderby' parameter of the export_order_csv AJAX action in versions up to 4.4.4. The vulnerability arises from insufficient escaping and lack of proper SQL query preparation in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions. Only the literal values 'date' and 'title' are sanitized, while other attacker-controlled strings are directly concatenated into the ORDER BY clause without using $wpdb->prepare() or an identifier whitelist. This allows authenticated users with administrator-level access to append additional SQL queries to extract sensitive information from the database.

An attacker with administrator-level privileges can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact availability or integrity but compromises confidentiality by allowing unauthorized data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the export_order_csv AJAX action. Avoid exposing the vulnerable plugin to untrusted administrators.