PT-2024-37384 · WordPress · Learnpress

Khayal Farzaliyev + 1 · Published 2024-07-02 · Updated 2024-07-02 · CVE-2024-6099

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.6.8.1

Description: The issue allows unauthenticated attackers to bypass user registration restrictions. This is caused by missing checks in the check validate fields function, making it possible for attackers to register as the default role on the site, even if registration is disabled.

Recommendations: For versions up to, and including, 4.2.6.8.1, consider disabling the check validate fields function in the checkout until a patch is available. Restrict access to user registration to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-420

Related Identifiers

CVE-2024-6099

Affected Products

Learnpress

References · 5

• https://plugins.trac.wordpress.org/changeset/3109339 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-6099 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6099 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/7ee714c7-4c9b-4627-9ba9-f83aeca6a0a5?source=cve · Note
• https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.1/inc/class-lp-checkout.php#L124 · Note