CVE-2023-6567

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jan 11, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-65686.1A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the ContentCVE-2023-65698.2External Control of File Name or Path in h2oai/h2o-3CVE-2023-65706.5Server-Side Request Forgery (SSRF) in kubeflow/kubeflowCVE-2023-65716.1Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflowCVE-2023-65728.1Command Injection in GitHub repository gradio-app/gradio prior to main.CVE-2023-65735.5HPE OneView may have a missing passphrase during restore.CVE-2023-65748.8A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical. Affected by this issue is some unknown functionalitCVE-2023-65758.8A vulnerability was found in Byzoro S210 up to 20231121. It has been classified as critical. This affects an unknown part of the file /Tool/CVE-2023-65768.8A vulnerability was found in Byzoro S210 up to 20231123. It has been declared as critical. This vulnerability affects unknown code of the fiCVE-2023-65774.3A vulnerability was found in Byzoro PatrolFlow 2530Pro up to 20231126. It has been rated as problematic. This issue affects some unknown proCVE-2023-65786.5A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the fileCVE-2023-65799.8A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of t