WordfenceVULNRICHMENT:CVE-2024-4444CVE-2024-4444 LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.8 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
20.5%
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. This is due to missing checks in the ‘create_account’ function in the checkout. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.
CNA Affected
[
{
"vendor": "thimpress",
"product": "LearnPress – WordPress LMS Plugin",
"versions": [
{
"version": "*",
"status": "affected",
"lessThanOrEqual": "4.2.6.5",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]References
inky-knuckle-2c2.notion.site/Improper-Authentication-in-checkout-leads-privilege-escalation-of-unauthenticated-to-create-accoun-09da24a043884219a891dd1a0fc01af6
plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.5/inc/class-lp-checkout.php#L79
plugins.trac.wordpress.org/changeset/3082204/
www.wordfence.com/threat-intel/vulnerabilities/id/c9e1410f-10c9-4654-8b61-cfcdde696da7?source=cve
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.8 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
20.5%