LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication. [已公开] id: CVE-2024-11868 info: name: LearnPress < 4.2.7.4 - Course Material - Information Disclosure author: pussycat0x severity: medium description: | LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication. impact: | Unauthenticated attackers can access and extract sensitive paid course content, leading to intellectual property theft and privacy breaches. remediation: Update to the latest version beyond 4.2.7.3 or apply security patches provided by the vendor. reference: - https://wpscan.com/vulnerability/7524ffd8-3506-48f7-89b6-d07b40533756/8 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2024-11868 epss-score: 0.06589 epss-percentile: 0.90974 cwe-id: CWE-284 metadata: verified: true max-request:

未知