CVE-2021-24951: Thimpress Learnpress

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues

Affected products

• Thimpress Learnpress: before 4.1.4 (fixed in 4.1.4)

Published 2021-12-13. Last modified 2026-06-17.