CVE-2024-6088mediumCWE-862

CVE-2024-6088: falha de média gravidade em thimpress LearnPress – WordPress LMS Plugin…

LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.6%
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user registration to create a new account with the default role.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
thimpress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
CVEs relacionadas — thimpress LearnPress – WordPress LMS Plugin…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-8522CRITICALLearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'EPSS 62.9%CVE-2023-6567CRITICALLearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_byEPSS 51.4%CVE-2024-4434CRITICALLearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL InjectionEPSS 36.9%CVE-2024-8529CRITICALLearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'EPSS 12.1%CVE-2023-6634HIGHLearnPress <= 4.2.5.7 - Command InjectionEPSS 8.6%CVE-2026-104736CRITICALLearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' ParameterEPSS 2.5%