Lucene search
MitreCVELIST:CVE-2020-7916HistoryMar 16, 2020 - 5:04 p.m.
CVE-2020-7916
2020-03-1617:04:42
mitre
www.cve.org
2
EPSS
0.001
Percentile
28.4%
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data.
Related
cve
cve
CVE-2020-7916
2020-03-16 18:15:13
prion
prion
Authentication flaw
2020-03-16 18:15:00
nvd
nvd
CVE-2020-7916
2020-03-16 18:15:13
patchstack
patchstack
WordPress LearnPress plugin <= 3.2.6.6 - Privilege Escalation vulnerability
2020-03-16 00:00:00
wpvulndb
wpvulndb
LearnPress < 3.2.6.7 - Privilege Escalation
2020-03-16 00:00:00
openvas
openvas