PT-2024-28578 · Thimpress · Learnpress

Rafie Muhammad · Published 2024-08-26 · Updated 2024-09-18 · CVE-2024-39641

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThimPress LearnPress versions through 4.2.6.8.2

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability. It affects the WordPress LearnPress Plugin, allowing for potential exploitation. To remediate the issue, an upgrade to version 4.2.6.9 is recommended.

Recommendations For versions through 4.2.6.8.2, upgrade to version 4.2.6.9 to resolve the issue. As a temporary workaround, consider implementing additional security measures to minimize the risk of CSRF exploitation until the upgrade can be applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-39641

Affected Products

Learnpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-39641 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39641 · Vendor Advisory
• https://twitter.com/transilienceai/status/1829198837837124031 · Twitter Post
• https://t.me/cvenotify/92275 · Telegram Post
• https://twitter.com/transilienceai/status/1829585166894809339 · Twitter Post
• https://twitter.com/CVEnew/status/1828179176626475208 · Twitter Post
• https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-plugin-4-2-6-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note