CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user registration to create a new account with the default role.
Explanation of Vulnerability in Simple Terms
LearnPress versions up to 4.2.6.8.1 fail to properly check user permissions before allowing access to certain functions. An unauthenticated attacker can read sensitive information without logging in or having any special access. The vulnerability affects the WordPress plugin directly and requires no user interaction to exploit.
What an attacker can do
Read sensitive information from the site without authentication.
Potential impact on your site
Unauthorized users can access private course or student data exposed by the plugin.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
