CVE-2024-1208: fallo de gravedad media en StellarWP LearnDash LMS
LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 5.3epss 5.3%
The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
StellarWP · LearnDash LMSCVEs relacionadas — StellarWP LearnDash LMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-1209MEDIUMLearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignmentsEPSS 2.4%CVE-2023-3105HIGHLearnDash LMS <= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 2.2%CVE-2024-1210MEDIUMLearnDash LMS <= 4.10.1 - Sensitive Information Exposure via APIEPSS 2.0%CVE-2026-12483HIGHLearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload HandlerEPSS 0.6%CVE-2026-3079MEDIUMLearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' ParameterEPSS 0.3%CVE-2026-12843MEDIUMLearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST EndpointEPSS 0.3%