PT-2024-37378 · WordPress · Learnpress

Khayal Farzaliyev + 1 · Published 2024-07-02 · Updated 2024-07-02 · CVE-2024-6088

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.6.8.1

Description: The issue allows unauthorized user registration due to a missing capability check on the register function. This enables unauthenticated attackers to bypass disabled user registration and create a new account with the default role.

Recommendations: For versions up to, and including, 4.2.6.8.1, consider disabling the register function until a patch is available to prevent unauthorized user registration.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-6088

Affected Products

Learnpress

References · 6

• https://plugins.trac.wordpress.org/changeset/3109339 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-6088 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6088 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/04e0ddff-16af-4c85-b5b0-cf767684ee08?source=cve · Note
• https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.1/inc/class-lp-forms-handler.php#L235 · Note
• https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.1/inc/jwt/includes/class-jwt-public.php#L127 · Note