CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. This is due to missing or incorrect nonce validation on the filter_users functions. This makes it possible for unauthenticated attackers to elevate their privileges to that of a teacher via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
LearnPress versions up to 4.0.0 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators or users. An attacker can craft a malicious link or page that, when visited by a logged-in user, executes unwanted operations such as creating courses, modifying settings, or changing user roles. The vulnerability requires user interaction but can result in complete compromise of site functionality and data.
What an attacker can do
Perform unauthorized actions (create courses, modify settings, change user roles) on behalf of a logged-in site administrator or user.
Potential impact on your site
Attackers can hijack admin or user accounts to modify course content, user permissions, site settings, or steal sensitive course and student data without your knowledge.
Conditions required to exploit
A logged-in LearnPress user must visit an attacker-controlled page or click a malicious link while authenticated to the WordPress site.
Key dates
External resources
Related vulnerabilities
