Input validation vulnerability in WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses 3.2.3

The WP Courses LMS Online Courses Builder is a plugin for WordPress which is used to create and manage online courses. A vulnerability has been discovered in all versions of this plugin up to and including version 3.2.3. This vulnerability allows an unauthenticated attacker to perform certain actions such as adding, deleting or renaming lesson modules without authorization. This is possible because the plugin does not have validation for certain functions which are connected to AJAX in the ~/ajax/ajax-lesson-order.php file. To exploit this vulnerability, an attacker must be able to trick a site administrator into clicking a malicious link.