Authorization Bypass in LearnPress WordPress LMS Plugin

Executive Summary

The LearnPress WordPress plugin up to version 4.4.10 has an authorization bypass flaw. It fails to verify user permissions properly, allowing authenticated attackers with subscriber access or higher to bypass restrictions. This enables them to enumerate all site users and extract full email addresses, including those of administrators, by exploiting search responses against user_login and user_email columns.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor WordPress sites running LearnPress plugin versions up to 4.4.10. Check for unusual user enumeration attempts or unauthorized access patterns. Review server logs for repeated requests targeting user data endpoints. Use WordPress security plugins to scan for known vulnerable plugin versions.

Useful 0 Not Useful 0

Impact Analysis

If exploited, attackers could gather sensitive user data like email addresses, including those of administrators. This could lead to phishing attacks, unauthorized access, or further exploitation of user accounts. The vulnerability requires only low-privilege access to initiate, increasing risk for all WordPress sites using the affected plugin versions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing personal data (email addresses) without consent. For HIPAA, if user emails are tied to protected health information, unauthorized access may breach compliance. Organizations must address this to avoid legal penalties and reputational damage from data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update the LearnPress plugin to the latest version beyond 4.4.10 immediately to patch the authorization bypass vulnerability.

Useful 0 Not Useful 0