CVE-2024-2115

Summary

CVE-2024-2115 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the LearnPress – WordPress LMS Plugin. This issue, present in all versions up to 4.0.0, stems from insufficient nonce validation on the filter_users functions. Consequently, unauthenticated attackers can successfully trick site administrators into performing actions, such as granting teacher privileges, via maliciously crafted links. This CSRF flaw poses a significant security risk to WordPress sites using the LearnPress plugin.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.