CVE-2022-47615
published 2023-01-26CVE-2022-47615: Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
PriorityP179critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
5.06%
91.3th percentile
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| thimpress | learnpress | < 4.2.0 | 4.2.0 |
| thimpress | learnpress_wordpress_lms_plugin | n/a – 4.1.7.3.2 | — |
Detection & IOCsextracted from sources · hover to see the quote
url/wp-json/lp/v1/courses/archive-course?template_path=..%2F..%2F..%2Fetc%2Fpasswd&return_type=html↗
- →Look for GET requests to the LearnPress REST API endpoint /wp-json/lp/v1/courses/archive-course with a `template_path` parameter containing path traversal sequences (e.g., ..%2F..%2F..%2F) and `return_type=html`. ↗
- →Successful exploitation returns HTTP 200 with a JSON body containing both `"status":` and `"pagination":` fields, and a Content-Type header of `application/json`, with the LFI file content (e.g., `root:.*:0:0:`) embedded in the response body. ↗
- →Fingerprint vulnerable WordPress installations by searching for the string `/wp-content/plugins/learnpress` in HTTP response bodies. ↗
- ·The vulnerability affects LearnPress plugin versions <= 4.1.7.3.2 only; version 4.2.0 and above are patched. ↗
- ·The LFI is unauthenticated (no privileges required), exploitable remotely with no user interaction, making it trivially weaponizable at scale. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wr5x-fcf4-h5qm: Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4
ghsa_unreviewed·2023-07-06
CVE-2022-47615 [CRITICAL] CWE-434 GHSA-wr5x-fcf4-h5qm: Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
VulnCheck
thimpress learnpress Unrestricted Upload of File with Dangerous Type
vulncheck·2022·CVSS 9.3
CVE-2022-47615 [CRITICAL] thimpress learnpress Unrestricted Upload of File with Dangerous Type
thimpress learnpress Unrestricted Upload of File with Dangerous Type
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
Affected: thimpress learnpress
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-plugin-4-1-7-3-2-local-file-inclusion; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-03-06&host_type=src&vulnerability=cve-2022-47615; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-03-07&host_type=src&vulnerability=cve-2022-47615; https://dashboard.shadowserver.org/st
No detection rules found.
Nuclei
LearnPress Plugin < 4.2.0 - Local File Inclusion
nuclei·CVSS 9.8
CVE-2022-47615 [CRITICAL] LearnPress Plugin < 4.2.0 - Local File Inclusion
LearnPress Plugin < 4.2.0 - Local File Inclusion
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
Template:
id: CVE-2022-47615
info:
name: LearnPress Plugin < 4.2.0 - Local File Inclusion
author: DhiyaneshDK
severity: critical
description: |
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
impact: |
Successful exploitation of this vulnerability could lead to unauthorized access to sensitive files, remote code execution, or information disclosure.
remediation: |
Upgrade to the latest version of LearnPress Plugin (4.2.0 or higher) to mitigate this vulnerability.
reference:
- https://github.com/RandomRobbieBF/CVE-2022-47615/tree/main
- https://nvd.nist.gov/vuln/detail/CVE-2022-47615
- https://patch
https://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress-plugin-version/https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-plugin-4-1-7-3-2-local-file-inclusion?_s_id=cvehttps://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress-plugin-version/https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-plugin-4-1-7-3-2-local-file-inclusion?_s_id=cve
2023-01-26
Published
Exploited in the wild