Security readout for executives and security teams
Plain-English summary
LearnPress, a WordPress learning management plugin, had a critical SQL injection issue in versions up to 4.1.7.3.2. A logged-in attacker could potentially interfere with database queries, risking sensitive data exposure and limited data or service impact.
Executive priority
Treat this as urgent for any WordPress site using LearnPress. The issue is critical because authenticated users may reach database-backed behavior with high confidentiality impact, but evidence provided does not confirm active exploitation.
Technical view
CVE-2022-45820 is a CWE-89 SQL injection in ThimPress LearnPress for WordPress, affecting versions <= 4.1.7.3.2. CVSS 3.1 is 9.1 with network access, low complexity, low privileges, no user interaction, changed scope, high confidentiality impact, and low integrity and availability impact.
Likely exposure
Exposure is likely limited to WordPress sites running LearnPress <= 4.1.7.3.2. Risk is higher where untrusted users can create accounts or otherwise obtain low-privileged access.
Exploitation context
The CVE bundle does not show CISA KEV listing or confirmed active exploitation. Patchstack identifies this as an authenticated SQL injection vulnerability. No exploit code or operational exploitation details are needed to assess urgency.
Researcher notes
The public bundle lacks endpoint-level details, exact vulnerable parameter names, and a confirmed fixed version. Base assessment on the affected range, CVSS vector, CWE-89 classification, and Patchstack references without assuming exploit availability.
Mitigation direction
- Inventory WordPress sites for LearnPress and installed plugin version.
- Update LearnPress to a vendor-supported release newer than 4.1.7.3.2.
- If update is blocked, restrict LearnPress access to trusted authenticated users.
- Review vendor and Patchstack guidance for any additional mitigation details.
- Back up the site and database before remediation.
Validation and detection
- Confirm no production WordPress site runs LearnPress <= 4.1.7.3.2.
- Check whether public registration or low-trust user roles can access LearnPress features.
- Review WordPress and database logs for unusual authenticated LearnPress activity.
- Verify the plugin update completed successfully on every environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-45820 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L3.15.3Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-plugin-4-1-7-3-2-auth-sql-injection-sqli-vulnerability?_s_id=cveCVE reference · vdb-entry
- https://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress-plugin-version/CVE reference · technical-description
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.