CVE-2023-6634 is a high severity command injection flaw in the LearnPress plugin for WordPress. The get_content function passes user input to call_user_func, so unauthenticated attackers may run any public function that takes one parameter, which could lead to code execution. Update past 4.2.5.7.
What's affected
- Product: LearnPress from ThimPress, a WordPress plugin.
- Affected: all versions up to and including 4.2.5.7, per the record.
- Fixed version: not named in the record. Trac changeset 3013957 is linked; confirm in the changelog.
- Access needed: none, with high attack complexity (score 8.1).
The record gives a CVSS 3.1 base score of 8.1 (high) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
What to do now
- Check the LearnPress version on each site.
- Update to a release newer than 4.2.5.7.
- Review the site for new admin users, changed files and unexpected scheduled tasks if it was exposed.
- Reduce the surface by removing plugins and themes that you do not use.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-88 (Argument Injection): Input becomes part of an argument list for a function or command, so a caller can influence how it behaves beyond what the author intended. ; CWE-77 (Command Injection): Input is passed into a command or function call without neutralising it, so the caller can steer what gets run.
The record lists argument injection and command injection. The code calls a function whose name or argument comes from the request. Whoever sets those values chooses what runs, limited to public functions that take one parameter.
The attack complexity is high, which is why the score is 8.1 and not higher. That is not a reason to wait. The same plugin range carries CVE-2023-6567, so the update does double duty. After patching, a quick look for new accounts and changed files is cheap insurance.
Quick check
Does this give full control of the site?
The record says it could result in remote code execution, since an attacker may call any public function with one parameter. It does not describe a specific payload.
Is it the same bug as CVE-2023-6567?
No. Both affect LearnPress up to 4.2.5.7, but one is SQL injection and the other is command injection.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
