Thimpress - SQLi (CVE-2023-6567)

CVE-2023-6567 is a critical vulnerability in the LearnPress plugin for WordPress, which allows unauthenticated attackers to exploit a time-based SQL injection flaw in the handling of sorting parameters. This can lead to extraction of sensitive information from the application's database.

CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2023-6567 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2023-6567. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Adversaries have focused specifically on manipulating the sorting logic to trigger the SQL injection condition.