CVE-2024-1209: falha de média gravidade em StellarWP LearnDash LMS
LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 5.3epss 2.4%
The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attackers to obtain those uploads.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
StellarWP · LearnDash LMSCVEs relacionadas — StellarWP LearnDash LMS
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1208MEDIUMLearnDash LMS <= 4.10.2 - Sensitive Information Exposure via APIEPSS 5.3%CVE-2023-3105HIGHLearnDash LMS <= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 2.2%CVE-2024-1210MEDIUMLearnDash LMS <= 4.10.1 - Sensitive Information Exposure via APIEPSS 2.0%CVE-2026-12483HIGHLearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload HandlerEPSS 0.6%CVE-2026-3079MEDIUMLearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' ParameterEPSS 0.3%CVE-2026-12843MEDIUMLearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST EndpointEPSS 0.3%