Thimpress Learnpress
51 CVEs affecting Thimpress Learnpress. Latest disclosed: 2026-06-01. Critical: 8, High: 14.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8529 | Critical | 10.0 | 2024-09-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-co… |
CVE-2024-8522 | Critical | 10.0 | 2024-09-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/cours… |
CVE-2022-45808 | Critical | 9.9 | 2023-01-26 | SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. |
CVE-2024-4434 | Critical | 9.8 | 2024-05-14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and includi… |
CVE-2023-6567 | Critical | 9.8 | 2024-01-11 | The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to… |
CVE-2021-24951 | Critical | 9.8 | 2021-12-13 | The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/… |
CVE-2022-47615 | Critical | 9.3 | 2023-01-26 | Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. |
CVE-2022-45820 | Critical | 9.1 | 2023-01-26 | SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. |
CVE-2024-7548 | High | 8.8 | 2024-08-08 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and inclu… |
CVE-2024-6589 | High | 8.8 | 2024-07-25 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'rende… |
CVE-2024-4397 | High | 8.8 | 2024-05-14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materi… |
CVE-2024-2115 | High | 8.8 | 2024-04-05 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. This is due… |
CVE-2020-6010 | High | 8.8 | 2020-04-30 | LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection |
CVE-2023-6634 | High | 8.1 | 2024-01-11 | The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due… |
CVE-2022-3360 | High | 8.1 | 2022-10-31 | The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Objec… |
CVE-2020-11511 | High | 8.1 | 2021-07-30 | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher… |
CVE-2023-36516 | High | 7.6 | 2024-06-19 | Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3. |
CVE-2025-66054 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2023-36515 | High | 7.3 | 2024-06-19 | Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3. |
CVE-2018-16175 | High | 7.2 | 2019-01-09 | SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecifie… |