CVE-2024-10470

Summary

CVE-2024-10470 is a vulnerability affecting the WPLMS Learning Management System for WordPress and its WordPress LMS theme. The issue stems from insufficient file path validation and permissions checks in the readfile and unlink functions, which can be exploited by unauthenticated attackers to read or delete arbitrary files on the server. This susceptibility exists in all versions up to 4.962, posing a serious risk, especially when the file deleted is the wp-config.php file, enabling remote code execution. The vulnerability holds significance even when the theme is not activated.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.