PT-2020-16524 · WordPress · Wp-Courses

Bijingus · Published 2020-10-07 · Updated 2021-07-21 · CVE-2020-26876

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wp-courses plugin versions prior to 2.0.28

Description The issue allows remote attackers to bypass the intended payment step for course videos and materials. This is achieved by utilizing the /wp-json REST API, with show in rest enabled for custom post types, such as /wp-json/wp/v2/course and /wp-json/wp/v2/lesson. The issue has been exploited in the wild.

Recommendations For wp-courses plugin versions prior to 2.0.28, update to version 2.0.28 or later to resolve the issue. As a temporary workaround, consider disabling the REST API endpoints /wp-json/wp/v2/course and /wp-json/wp/v2/lesson until the update is applied.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-26876

Affected Products

Wp-Courses

References · 5

• 🔥 https://redtimmy.com/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials · Exploit
• https://osv.dev/vulnerability/CVE-2020-26876 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26876 · Security Note
• https://plugins.trac.wordpress.org/changeset/2389243 · Note
• https://plugins.trac.wordpress.org/changeset/2388997 · Note