The teachPress plugin for WordPress contains an SQL Injection vulnerability in the order parameter of the tpsearch shortcode in all releases up to 9.0.7. The flaw is caused by insufficient escaping of user input and a lack of prepared statements. An attacker who has logged on with Contributor level or higher can append rogue SQL statements to the constructed query and extract arbitrary data stored in the database.

WordPress installations that include the teachPress plugin version 9.0.7 or older, distributed by winkm89. Only users with Contributor or higher privileges can exploit the flaw, so the threat surface is limited to sites with such accounts.

The CVSS score of 6.5 classifies the issue as medium severity, and an EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because an active, authenticated account is required, the typical attack vector is via legitimate login credentials – users who already have Contributor access can use the shortcode to inject statements and leak data. The overall risk remains moderate, but any exposed sensitive data could be significant for the site owner.