CVE-2024-1289 — Improper Authorization in Learnpress

CWE-285 — Improper AuthorizationCWE-639 — Authorization Bypass Through User-Controlled KeyCWE-1289 — Improper Validation of Unsafe Equivalence in InputCWE-697 — Incorrect Comparison7 documents5 sources
Severity
5.4MEDIUMNVD
CNA6.5
EPSS
0.2%
top 57.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Thimpress LearnpressThimpress Learnpress Wordpress LMS Plugin FOR Create AND Sell Online Courses
Timeline
PublishedApr 9
Latest updateMay 30

Description

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user controlled key when looking up order information. This makes it possible for authenticated attackers to obtain information on orders placed by other users and guests, which can be leveraged to sign up for paid courses that were purchased by guests. Emails of other users are also exposed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶NVDthimpress/learnpress< 4.2.6.4

🔴Vulnerability Details

4
GHSA
`idna` accepts Punycode labels that do not produce any non-ASCII when decoded↗2024-12-09
▶
GHSA
AngularJS allows attackers to bypass common image source restrictions↗2024-09-09
▶
CVEList
LearnPress <= 4.2.6.3 - Insecure Direct Object Reference↗2024-04-09
▶
GHSA
GHSA-qh29-9j77-hqw6: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4↗2024-04-09
▶

📋Vendor Advisories

2
Red Hat
idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded↗2025-05-30
▶
Red Hat
angularjs: From NVD collector↗2024-09-09
▶
CVE-2024-1289 — Improper Authorization in Learnpress | cvebase