PT-2021-9421 · WordPress · Learnpress

Ramuel Gall · Published 2021-07-27 · Updated 2022-12-09 · CVE-2020-11511

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LearnPress plugin versions prior to 3.2.6.9 for WordPress

Description The issue allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter.

Recommendations For versions prior to 3.2.6.9, update to version 3.2.6.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the accept-to-be-teacher action parameter until the update is applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-11511

Affected Products

Learnpress

References · 7

• 🔥 http://packetstormsecurity.com/files/163538/WordPress-LearnPress-Privilege-Escalation.html · Exploit
• 🔥 https://wordfence.com/blog/2020/04/high-severity-vulnerabilities-patched-in-learnpress · Exploit
• https://osv.dev/vulnerability/CVE-2020-11511 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11511 · Security Note
• https://t.me/cibsecurity/26596 · Telegram Post
• https://cwe.mitre.org/data/definitions/862.html · Note
• https://wordpress.org/plugins/learnpress/#developers · Note