CVE-2026-77823: LearnPress WordPress Plugin SQL Injection

CVE-2026-77823 Overview

CVE-2026-77823 is a SQL Injection vulnerability in the LearnPress plugin for WordPress affecting all versions up to and including 4.4.4. The flaw resides in the export_order_csv AJAX action, where the orderby parameter is concatenated into an ORDER BY clause without proper sanitization or use of $wpdb->prepare(). Authenticated attackers with administrator-level access can inject additional SQL statements to exfiltrate sensitive database contents. The vulnerability is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated administrators can append arbitrary SQL to LearnPress order export queries, enabling extraction of sensitive data from the WordPress database.

Affected Products

LearnPress plugin for WordPress, versions up to and including 4.4.4
WordPress sites exposing the export_order_csv AJAX endpoint
Any deployment where LearnPress administrator accounts are shared or reachable by lower-trust users

Discovery Timeline

2026-09-01 - CVE-2026-77823 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-77823

Vulnerability Analysis

The vulnerability exists in the LearnPress order export workflow implemented in ExportOrderCSVAjax.php. When the export_order_csv AJAX action runs, it hands the user-supplied orderby value to LP_Order::handle_params_query_list_orders(), which sets the filter's order_by property before it reaches DataBase::execute().

The filter logic normalizes only the literal values date and title. Any other attacker-controlled string is assigned directly to order_by and concatenated into the final ORDER BY clause. Because the query is neither passed through $wpdb->prepare() nor validated against an identifier allowlist, injected SQL fragments become part of the executed statement.

An authenticated administrator can leverage this to append UNION-style subqueries or stacked expressions, returning arbitrary column data from tables such as wp_users or wp_usermeta through the CSV export.

Root Cause

The root cause is insufficient input validation on a SQL identifier field. The code accepts free-form strings for orderby and treats them as trusted SQL fragments. Correct handling requires a strict allowlist of column names or $wpdb->prepare() with the appropriate %i identifier placeholder introduced in modern WordPress releases.

Attack Vector

Exploitation requires an authenticated session with administrator privileges. The attacker sends a crafted request to the admin-ajax.php endpoint invoking the export_order_csv action with a malicious orderby value. The injected SQL executes with the database privileges of the WordPress site user, and results can be observed through the CSV response or via error-based inference.

See the Wordfence Vulnerability Report and the WordPress Export Order AJAX source for the affected code paths.

Detection Methods for CVE-2026-77823

Indicators of Compromise

Requests to wp-admin/admin-ajax.php with action=export_order_csv containing SQL keywords such as UNION, SELECT, SLEEP, or information_schema in the orderby parameter.
Unexpected CSV downloads from the LearnPress order export functionality outside normal administrative activity.
Database errors in PHP or MySQL logs referencing malformed ORDER BY clauses tied to LearnPress queries.

Detection Strategies

Inspect web server access logs for POST or GET requests to admin-ajax.php where action=export_order_csv and orderby contains non-alphanumeric SQL syntax.
Enable WordPress database query logging or MySQL general query logging to identify anomalous ORDER BY payloads referencing sensitive tables.
Deploy a Web Application Firewall (WAF) rule matching SQL metacharacters in the orderby parameter of the LearnPress AJAX action.

Monitoring Recommendations

Monitor administrator account activity, including new session creation, plugin usage, and CSV export events.
Alert on outbound transfers of unusually large or unexpected CSV files from wp-admin sessions.
Track changes to LearnPress plugin files and version metadata to confirm patched deployment.

How to Mitigate CVE-2026-77823

Immediate Actions Required

Upgrade the LearnPress plugin to a version later than 4.4.4 that addresses the orderby sanitization defect.
Audit WordPress administrator accounts, remove unused privileged users, and rotate credentials for any administrator suspected of compromise.
Enforce multi-factor authentication on all WordPress administrator accounts to reduce misuse of the required privilege level.

Patch Information

The LearnPress maintainers addressed the issue in the plugin's trunk. Review the fix in the WordPress Plugin Changeset and verify the deployed version incorporates the corrected LP_Order::handle_params_query_list_orders() and DataBase::execute() logic referenced in the WordPress Order Class Implementation and WordPress Database Class.

Workarounds

Deploy a WAF rule that rejects requests to admin-ajax.php with action=export_order_csv when orderby contains characters outside a strict allowlist such as [A-Za-z0-9_].
Restrict access to the WordPress admin interface by IP allowlisting until the patched plugin version is deployed.
Temporarily disable the LearnPress plugin on sites that do not actively use the order export feature.

bash

# Example Nginx location rule to block suspicious orderby payloads
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "export_order_csv") {
        if ($arg_orderby !~* "^(date|title|[A-Za-z0-9_]{1,32})$") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}