WordPress Plugin Vulnerabilities

LearnPress < 4.2.5.8 - Subscriber+ Arbitrary Course Progress Disclosure

Description

The plugin is vulnerable to Insecure Direct Object Reference in the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the details of another user's course progress.

Affects Plugins

Plugin icon
learnpress
Fixed in 4.2.5.8

References

CVE
CVE-2023-6223
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/215d5d9e-dabb-462d-8c51-952f8c497b78

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
lttn
Verified
No
WPVDB ID
1e1f0719-9cbd-43e9-bb49-f06c0b89e663

Timeline

Publicly Published
2024-01-02 (about 2 years ago)
Added
2024-01-03 (about 2 years ago)
Last Updated
2024-01-03 (about 2 years ago)

Other

Published
Title
Published
2024-04-05
Title
BookingPress < 1.0.82 - Authenticated (Customer+) Insecure Direct Object Reference
Published
2023-09-12
Title
wpDiscuz < 7.6.4 - Post Rating Increase/Decrease iva IDOR
Published
2025-06-06
Title
BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update
Published
2026-03-12
Title
Formidable Forms < 6.29 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter
Published
2022-10-21
Title
Quiz And Survey Master < 7.3.7 - Multiple Author+ IDOR