CVE-2024-12172: falha de alta gravidade em hookandhook WP Courses LMS – Online Courses…
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.8%
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user's metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
hookandhook · WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education CoursesCVEs relacionadas — hookandhook WP Courses LMS – Online Courses…
No mesmo produto, das mais perigosas para as menos.