Executive Summary

This vulnerability exists in the LearnPress WordPress LMS Plugin up to version 4.3.1, where the REST API endpoint for order statistics ('statistic' route) lacks proper permission checks. Specifically, the permission callback for this endpoint always returns true, allowing unauthenticated users to access order statistics data such as total revenue summaries and order status counts without any authentication or authorization. [1]

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated attacker can exploit this vulnerability to view sensitive order statistics data from the LearnPress plugin, including total revenue summaries and order status counts. This unauthorized data exposure could lead to information disclosure that might be used for malicious purposes such as competitive intelligence or targeted attacks. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if the LearnPress plugin's REST API endpoint for order statistics is accessible without authentication. Specifically, test the HTTP GET request to the endpoint `/wp-json/lp/v1/orders/statistic` on your WordPress site. If this endpoint returns order statistics data without requiring authentication, your system is vulnerable. A sample command using curl would be: `curl -X GET https://your-wordpress-site.com/wp-json/lp/v1/orders/statistic` [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable REST API endpoint by implementing authentication or permission checks, such as requiring logged-in users with appropriate capabilities to access the `statistic` route. Alternatively, temporarily disabling or removing the LearnPress plugin until an updated version with the fix is released can prevent unauthorized data access. [1]

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to access order statistics data, including total revenue summaries and order status counts, which could lead to unauthorized disclosure of potentially sensitive business information. This unauthorized data exposure may impact compliance with data protection regulations such as GDPR or HIPAA if the exposed data includes personal or sensitive information. However, the provided resources do not explicitly discuss compliance implications or whether personal data is involved. [1]

Useful 0 Not Useful 0