CVE-2020-6010
WordPress vulnerability analysis and mitigation

Overview

LearnPress WordPress plugin version prior to and including 3.2.6.7 was found to contain a SQL Injection vulnerability (CVE-2020-6010). The vulnerability was discovered in April 2020 and affected the LearnPress plugin, which is one of the most popular Learning Management System (LMS) plugins for WordPress with over 80,000 installations worldwide (Checkpoint Research).

Technical details

The vulnerability exists in the _get_items method of the LP_Modal_Search_Items class, which fails to properly sanitize user-supplied data from the GET/POST parameter 'current_items' before using it in an SQL query. The vulnerability can be triggered by an authenticated user by calling the Ajax method learnpress_modal_search_items (Checkpoint Research). The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

Impact

The vulnerability could allow attackers to steal personal information including names, emails, usernames, and passwords. Additionally, in educational contexts, attackers could potentially modify grades, forge certificates, retrieve test answers beforehand, and escalate their privileges to that of a teacher. The platforms also involve payment systems, making financial exploitation possible (Checkpoint Research).

Exploitability

The vulnerability requires authentication to exploit, but is relatively straightforward to execute through the Ajax method. A Metasploit module (auxiliary/scanner/http/wp_learnpress_sqli) has been developed for this vulnerability, indicating its practical exploitability (AttackerKB).

Mitigation and workarounds

Users are urged to upgrade to LearnPress version 3.2.6.9 or later to address this vulnerability. The fix was implemented by completely removing the vulnerable functions in the patched version (Checkpoint Research).

Community reactions

The vulnerability received significant attention due to its timing during the COVID-19 pandemic when educational institutions were rapidly transitioning to online learning platforms. Security researchers emphasized the critical nature of the vulnerability given the increased reliance on e-learning platforms during this period (Hacker News).

Additional resources


SourceThis report was generated using AI

Related WordPress vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-77115HIGH7.1
  • brave-popup-builder
NoYesAug 23, 2026
CVE-2026-77116MEDIUM4.3
  • brave-popup-builder
NoYesAug 23, 2026
CVE-2026-14853MEDIUM4.3
  • woocommerce-bookings
NoYesAug 23, 2026
CVE-2026-77003LOW2.7
  • content-mask
NoYesAug 23, 2026
CVE-2026-13598NONEN/A
  • restrictmate
NoYesAug 23, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management