CVE-2023-6567 is a critical time-based SQL injection in the LearnPress plugin for WordPress. The order_by parameter is not escaped, so unauthenticated attackers can append queries and extract data. The record lists versions up to 4.2.5.7. Update to a later release.
What's affected
- Product: LearnPress from ThimPress, a WordPress learning management plugin.
- Affected: all versions up to and including 4.2.5.7, per the record.
- Fixed version: not named in the record. A Trac changeset (3013957) is linked, so confirm the release in the changelog.
- Access needed: none. The score is 9.8.
The record gives a CVSS 3.1 base score of 9.8 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
What to do now
- Check the LearnPress version on each site.
- Update to a release newer than 4.2.5.7 and confirm in the changelog that it covers the Trac changeset.
- Look at web and database logs for long-running requests that include the order_by parameter.
- Assume student and customer records were readable if the site ran an affected version while public. Follow your breach notification process if you find evidence.
- Back up the site before the update and test enrolment and payment flows after it.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-89 (SQL Injection): User controlled values are placed into a database query without proper escaping or parameter binding, so the query text itself can be changed.
The record lists SQL injection. The order_by value is placed into a query without escaping or preparation, so an outside party can change the query. Time-based means the attacker infers data from how long the database takes to answer, which works even when no error text is shown.
There is no login in the way, and learning sites hold names, emails and sometimes payment related records. Because the same release range also carries CVE-2023-6634, a code injection flaw, updating LearnPress closes two critical or high items at once.
Try it yourself
This demo shows how reachability analysis separates findings that can actually be hit from those that cannot.
Click through it at your own pace, or open it full screen.
Quick check
Does this need a login?
No. The record says unauthenticated attackers can exploit it.
What is time-based SQL injection?
It is a way to read data by measuring how long the database takes to respond to crafted input. It works even when the page shows no database output.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
