PT-2024-38964 · WordPress · Uncanny Groups For Learndash

Karl Emil Nikka · Published 2024-09-25 · Updated 2024-10-02 · CVE-2024-8349

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: The Uncanny Groups for LearnDash plugin for WordPress versions up to, and including, 6.1.0.1

Description: The issue arises from the plugin's failure to properly restrict what users a group leader can edit. This allows authenticated attackers with group leader-level access and above to change admin account email addresses, potentially leading to admin account access.

Recommendations: For versions up to, and including, 6.1.0.1, update to a version that properly restricts user editing capabilities for group leaders. As a temporary workaround, consider restricting group leader-level access to prevent potential exploitation until a patch is available.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-8349

Affected Products

Uncanny Groups For Learndash

References · 10

• 🔥 https://github.com/karlemilnikka/CVE-2024-8349-and-CVE-2024-8350 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8349 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8349 · Vendor Advisory
• https://t.me/latest_high_impact_cve/1206 · Telegram Post
• https://t.me/latest_high_impact_cve/1207 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/64cf0ae2-8d66-40d1-8bb6-0cab1dafab0d?source=cve · Note
• https://t.me/cvenotify/95890 · Telegram Post
• https://t.me/cvenotify/96832 · Telegram Post
• https://t.me/cvedetector/6279 · Telegram Post
• https://t.me/cvenotify/96824 · Telegram Post