CVE-2023-6567

Summary

CVE-2023-6567: Unauthenticated attackers can exploit the LearnPress plugin for WordPress through a time-based SQL Injection vulnerability, affecting versions up to 4.2.5.7. The issue arises from insufficient escaping of user-supplied 'order_by' parameter and lack of preparation of existing SQL queries. This vulnerability allows attackers to append malicious SQL queries, potentially leading to extraction of sensitive data from the database.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.