CVE-2026-77823: LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

Q: Who can exploit this issue?

An attacker must already be authenticated with administrator-level access or higher in WordPress. The vulnerable request is the export_order_csv AJAX action, using a malicious orderby parameter.

Q: Are standard order sorting values affected?

The literal orderby values date and title are normalized. Other attacker-controlled values are assigned directly to the order_by filter and concatenated into the SQL ORDER BY clause.

Q: What could an attacker do with successful exploitation?

A successful attacker can append additional SQL queries to existing queries and use them to extract sensitive information from the WordPress database. The provided impact information identifies confidentiality impact only; integrity and availability impacts are not indicated.

Q: How can I determine whether my site is affected?

Sites using LearnPress version 4.4.4 or earlier are affected according to the provided information. Review access to administrator-level WordPress accounts and requests to the export_order_csv AJAX action that include unexpected orderby values.

Published Sep 1, 2026

Updated

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LPOrder::handleparamsquerylistorders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's orderby property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected Software

1 affected component

LearnPress<=4.4.4

Event History

Sep 1, 2026

CVE Published

via MITRE·04:27 AM

Data Sourced

via MITRE·04:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must already be authenticated with administrator-level access or higher in WordPress. The vulnerable request is the export_order_csv AJAX action, using a malicious orderby parameter.

Are standard order sorting values affected?

The literal orderby values date and title are normalized. Other attacker-controlled values are assigned directly to the order_by filter and concatenated into the SQL ORDER BY clause.

What could an attacker do with successful exploitation?

A successful attacker can append additional SQL queries to existing queries and use them to extract sensitive information from the WordPress database. The provided impact information identifies confidentiality impact only; integrity and availability impacts are not indicated.

How can I determine whether my site is affected?

Sites using LearnPress version 4.4.4 or earlier are affected according to the provided information. Review access to administrator-level WordPress accounts and requests to the export_order_csv AJAX action that include unexpected orderby values.

CVE-2026-77823: LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are standard order sorting values affected?

What could an attacker do with successful exploitation?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are standard order sorting values affected?

What could an attacker do with successful exploitation?

How can I determine whether my site is affected?