CVE-2024-13599
📋 TL;DR
This stored XSS vulnerability in LearnPress WordPress plugin allows authenticated attackers with LP Instructor access or higher to inject malicious scripts into lesson names. When users view affected pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. All WordPress sites using LearnPress versions up to 4.2.7.5 are affected.
💻 Affected Systems
- LearnPress - WordPress LMS Plugin
📦 What is this software?
Learnpress by Thimpress
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack user sessions, deface websites, or redirect users to malicious sites, potentially leading to complete site compromise.
Likely Case
Attackers with instructor access inject malicious scripts to steal user session cookies or credentials, potentially escalating privileges to administrator level.
If Mitigated
With proper input validation and output escaping, the vulnerability is prevented, though instructor-level accounts could still be compromised through other means.
🎯 Exploit Status
Exploitation requires authenticated access with LP Instructor privileges or higher. The vulnerability is straightforward to exploit once an attacker has appropriate credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.7.6 and later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3226650/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find LearnPress and click 'Update Now'. 4. Verify update to version 4.2.7.6 or later.
🔧 Temporary Workarounds
Temporary Input Sanitization
allAdd custom sanitization filter for lesson names
Add to theme's functions.php: add_filter('learnpress_lesson_name', 'esc_html');
🧯 If You Can't Patch
- Remove LP Instructor role from untrusted users
- Implement web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > LearnPress version. If version is 4.2.7.5 or lower, you are vulnerable.Check Version:
wp plugin list --name=learnpress --field=versionVerify Fix Applied:
After updating, verify LearnPress version is 4.2.7.6 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual lesson name updates by instructor accounts
- JavaScript payloads in lesson name fields
Network Indicators:
- Unexpected external script loads from lesson pages
SIEM Query:
source="wordpress" AND ("lesson_name" OR "learnpress") AND ("script" OR "javascript" OR "onload" OR "onerror")