CVE-2026-77823: LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LPOrder::handleparamsquerylistorders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's orderby property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated with administrator-level access or higher in WordPress. The vulnerable request is the export_order_csv AJAX action, using a malicious orderby parameter.
Are standard order sorting values affected?
The literal orderby values date and title are normalized. Other attacker-controlled values are assigned directly to the order_by filter and concatenated into the SQL ORDER BY clause.
What could an attacker do with successful exploitation?
A successful attacker can append additional SQL queries to existing queries and use them to extract sensitive information from the WordPress database. The provided impact information identifies confidentiality impact only; integrity and availability impacts are not indicated.
How can I determine whether my site is affected?
Sites using LearnPress version 4.4.4 or earlier are affected according to the provided information. Review access to administrator-level WordPress accounts and requests to the export_order_csv AJAX action that include unexpected orderby values.