Login Sign Up

CVE-2024-6099

5.3 MEDIUM
Authentication Bypass

📋 TL;DR

This vulnerability allows unauthenticated attackers to bypass user registration controls in the LearnPress WordPress LMS plugin. Attackers can register accounts with the default role even when registration is disabled, affecting WordPress sites using vulnerable plugin versions.

💻 Affected Systems

Products:
  • LearnPress - WordPress LMS Plugin
Versions: Up to and including 4.2.6.8.1
Operating Systems: All
Default Config Vulnerable: ⚠️ Yes
Notes: Affects WordPress installations with LearnPress plugin enabled, regardless of user registration settings.

📦 What is this software?

Learnpress by Thimpress

View all CVEs affecting Learnpress →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers create administrative accounts, gain full control of the WordPress site, and potentially compromise the entire web server infrastructure.

🟠

Likely Case

Attackers create user accounts to access restricted content, post spam, or use the site as a foothold for further attacks.

🟢

If Mitigated

With proper monitoring, unauthorized accounts can be detected and removed before causing significant damage.

🌐 Internet-Facing: HIGH
🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

The vulnerability is in a public function with missing validation checks, making exploitation straightforward.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.2.6.8.2 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3109339/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find LearnPress and click 'Update Now'. 4. Verify version is 4.2.6.8.2 or higher.

🔧 Temporary Workarounds

Disable LearnPress Plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate learnpress

Restrict Access to Checkout

all

Use web application firewall to block suspicious registration attempts

🧯 If You Can't Patch

  • Implement strict user account monitoring and review all new registrations
  • Enable two-factor authentication for all user roles and implement IP-based rate limiting

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → LearnPress version. If version is 4.2.6.8.1 or lower, you are vulnerable.

Check Version:

wp plugin get learnpress --field=version

Verify Fix Applied:

After updating, verify LearnPress version is 4.2.6.8.2 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

  • Unusual user registration activity, especially when registration is disabled
  • Multiple user accounts created from same IP in short timeframe

Network Indicators:

  • HTTP POST requests to /checkout endpoint with registration parameters
  • Unusual traffic patterns to user registration endpoints

SIEM Query:

source="wordpress.log" AND "user registered" AND NOT "admin" AND rate > 5 per hour

📊 Metadata

CVE ID: CVE-2024-6099
CVSS v3 Score: 5.3 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: July 2, 2024
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON