CVE-2024-13127
📋 TL;DR
This vulnerability in the LearnPress WordPress plugin allows administrators to inject malicious scripts into plugin settings, which then execute when other users view those settings. It affects WordPress sites using LearnPress versions before 4.2.7.5.1, particularly in multisite configurations where unfiltered_html is restricted.
💻 Affected Systems
- LearnPress WordPress Plugin
📦 What is this software?
Learnpress by Thimpress
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to site takeover, data theft, or malware distribution to visitors.
Likely Case
Privileged user (admin) injects malicious scripts that affect other users viewing plugin settings, potentially stealing session cookies or redirecting users.
If Mitigated
Limited to authenticated admin users only, with impact contained to users accessing affected plugin settings pages.
🎯 Exploit Status
Exploitation requires admin privileges. Attack vector is through plugin settings interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.7.5.1
Vendor Advisory: https://wpscan.com/vulnerability/003ac248-74db-4b83-af0b-aa37ffb9b3d3/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find LearnPress plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download version 4.2.7.5.1+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Restrict Admin Access
allLimit administrative access to trusted users only and implement strong authentication controls.
Disable Plugin
linuxTemporarily disable LearnPress plugin until patched.
wp plugin deactivate learnpress
🧯 If You Can't Patch
- Implement strict access controls for admin accounts and monitor admin activity logs.
- Use web application firewall (WAF) rules to block XSS payloads in plugin settings endpoints.
🔍 How to Verify
Check if Vulnerable:
Check LearnPress plugin version in WordPress admin panel under Plugins > Installed Plugins.Check Version:
wp plugin get learnpress --field=versionVerify Fix Applied:
Confirm LearnPress version is 4.2.7.5.1 or higher in plugin details.📡 Detection & Monitoring
Log Indicators:
- Unusual admin activity modifying LearnPress settings
- POST requests to learnpress settings endpoints with script tags
Network Indicators:
- HTTP requests containing script payloads to /wp-admin/admin.php?page=learnpress-settings
SIEM Query:
source="wordpress" AND (uri_path="/wp-admin/admin.php" AND query_string="page=learnpress-settings") AND (http_method="POST" AND content="<script")