CVE-2023-6634 HIGH

CVE-2023-6634: LearnPress <= 4.2.5.7 - Command Injection

Vendor Thimpress
Product LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Weakness CWE-88
Published January 11, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for unauthenticated attackers to execute any public function with one parameter, which could result in remote code execution.

Key dates

02Disclosure timeline

January 11, 2024 CVE published
April 8, 2026 Record updated