CVE-2024-11868 LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API

What is CVE-2024-11868?

CVE-2024-11868 is a medium-severity vulnerability in thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses, published on 10 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. This makes it possible for unauthenticated attackers to extract potentially sensitive paid course material.

Weakness: CWE-284

Which versions are affected by CVE-2024-11868?

It affects 1 product.

Products include Thimpress Learnpress.

How do I fix CVE-2024-11868?

No fix has been published for CVE-2024-11868 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-11868 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11868 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

• CVE-2024-8522 LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' Critical 10.0
• CVE-2024-8529 LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields' Critical 10.0
• CVE-2022-45808 WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection Critical 9.9
• CVE-2024-4434 LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection Critical 9.8
• CVE-2023-6567 LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fwxq-9276-7658.