The LearnPress plugin for WordPress contains an SQL injection flaw in the export_order_csv AJAX action, triggered by unsanitized use of the 'orderby' parameter. Only the values 'date' and 'title' are properly validated; any other input is inserted directly into the ORDER BY clause of the query built by LP_Order::handle_params_query_list_orders() and DataBase::execute(). An authenticated attacker with administrator access can therefore append arbitrary SQL code, resulting in the execution of unintended queries and the disclosure of confidential information such as user records or course content. The weakness is a classic instance of CWE‑89: SQL Injection.

WordPress sites that have installed the LearnPress LMS plugin version 4.4.4 or earlier are affected. These sites provide an export order CSV feature that is accessed via the Ajax endpoint handled by ExportOrderCSVAjax.php. The vulnerability is specific to the LearnPress plugin by thimpress and does not affect other plugins or WordPress core.

The CVSS base score of 4.9 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a known exploited issue. However, the flaw requires authenticated administrator privileges, meaning it is limited to users that already have elevated access. An attacker who steals or compromises such credentials can leverage the injection to read database contents, potentially compromising user data and business information. The overall risk remains moderate, but the impact on confidentiality for sites with sensitive data could be significant.