CVE-2023-28777: 
WordPress vulnerability analysis and mitigation

A SQL Injection vulnerability (CVE-2023-28777) was discovered in LearnDash LMS WordPress plugin affecting versions through 4.5.3. The vulnerability was reported on March 24, 2023, and publicly disclosed on October 31, 2023. The issue stems from improper neutralization of special elements used in SQL commands in the plugin (NVD, Patchstack).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and has received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability requires contributor-level privileges to exploit (NVD, WPScan).

If exploited, this SQL injection vulnerability could allow attackers to directly interact with the database, potentially leading to unauthorized access to sensitive information, modification of database contents, and possible compromise of the WordPress installation (Patchstack).

The vulnerability has been patched in LearnDash LMS version 4.5.3.1. Users are strongly advised to update to this version or later to resolve the security issue. Patchstack has also issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).