WordPress Plugin Vulnerabilities

LearnPress – WordPress LMS Plugin < 4.2.6.8.2 - Missing Authorization to Unauthenticated User Registration Bypass

Description

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user registration to create a new account with the default role.

Affects Plugins

Plugin icon
learnpress
Fixed in 4.2.6.8.2

References

CVE
CVE-2024-6088
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/04e0ddff-16af-4c85-b5b0-cf767684ee08

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
shaman0x01
Verified
No
WPVDB ID
4137c284-4393-4818-b6fb-5661a3e02e0b

Timeline

Publicly Published
2024-07-01 (about 2 years ago)
Added
2024-07-02 (about 2 years ago)
Last Updated
2024-07-03 (about 2 years ago)

Other

Published
Title
Published
2024-04-08
Title
5 star review funnel for Google Reviews, Trustpilot, ProvenExpert and more | RRatingg < 1.3.02 - Missing Authorization
Published
2025-02-28
Title
Secure Copy Content Protection and Content Locking < 4.4.8 - Missing Authorization to Unauthenticated User Email Retrieval via ays_sccp_reports_user_search Function
Published
2025-10-16
Title
Front End Users < 3.2.34 - Missing Authorization
Published
2021-07-20
Title
WP SEO TDK <= 2.1.2 - Unauthenticated Setting Update to Stored XSS
Published
2026-07-09
Title
KiviCare < 4.5.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint