Insecure Direct Object Reference in LearnPress Plugin for WordPress

CVE-2023-6223

Summary

The LearnPress plugin for WordPress suffers from an Insecure Direct Object Reference vulnerability that impacts all versions up to and including 4.2.5.7. This issue is found in the /wp-json/lp/v1/profile/course-tab REST API, where the absence of proper validation on the 'userID' parameter allows authenticated users with subscriber-level access and above to exploit the vulnerability. Attackers can potentially gain unauthorized access to sensitive information such as another user's course progress, posing a significant risk to user privacy and data integrity.

References