6.5

CVE-2020-7916

LearnPress <= 3.2.6.6 - Privilege Escalation

be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data.
Mögliche Gegenmaßnahme
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Update to version 3.2.6.8, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Version *-3.2.6.6
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Thimpress ≫ Learnpress SwPlatformwordpress Version <= 3.2.6.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.589
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://wordpress.org/plugins/learnpress/#developers
Third Party Advisory
Release Notes