WordPress Plugin Vulnerabilities

LearnPress – WordPress LMS Plugin < 4.2.6.8.1 - Basic Information Disclosure via JSON API

Description

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of get_items_permissions_check function. This makes it possible for unauthenticated attackers to extract basic information about website users, including their emails

Affects Plugins

Plugin icon
learnpress
Fixed in 4.2.6.8.1

References

CVE
CVE-2024-5483
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/122b75d2-e882-45b9-baf1-acf847f8d60a

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Khayal Farzaliyev (shaman0x01)
Verified
No
WPVDB ID
1f253156-333b-4be6-b727-06237567be1e

Timeline

Publicly Published
2024-06-04 (about 1 year ago)
Added
2024-06-04 (about 1 year ago)
Last Updated
2024-06-05 (about 1 year ago)

Other

Published
Title
Published
2023-10-13
Title
Libsyn Publisher Hub <= 1.4.4 - Sensitive Information Exposure
Published
2025-12-19
Title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.11.1 - Unauthenticated Sensitive Information Exposure
Published
2020-06-28
Title
ACF to REST API < 3.3.0 - Unauthenticated Arbitrary wp_options Disclosure
Published
2024-10-28
Title
Exclusive Addons for Elementor < 2.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
Published
2022-10-17
Title
WP < 6.0.3 - Content from Multipart Emails Leaked