Log out
Get PRO

Latest

Access violation vulnerability in LearnPress – WordPress LMS Plugin 4.2.5.7

  • Severity: medium-risk
  • Status: Fixed
  • Publication: January 2, 2024

The LearnPress WordPress plugin has a security flaw in all versions before 4.2.5.7 which can be exploited by attackers with subscriber-level access. The flaw is related to the /wp-json/lp/v1/profile/course-tab REST API, and is caused by the lack of validation of the ‘userID’ parameter, which can be controlled by the user. This allows attackers to access the progress of another user’s course.

Detected in:

LearnPress – WordPress LMS Plugin fixed vulnerable versions: >= * <= 4.2.5.7
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses fixed vulnerable versions:

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

  • Incorrect?

Is this information incorrect? Please leave us a message.