LearnPress WordPress LMS Plugin Missing Authentication Vulnerability Allowing Unauthenticated Course Modification

A vulnerability exists in the LearnPress WordPress LMS Plugin, in all versions through 4.3.2, due to a lack of proper capability checks in the 'catch_lp_ajax' function. This flaw enables unauthenticated attackers to alter course content by adding, removing, updating, or reordering sections, as well as modifying section items.

Impact

Exploitation of this vulnerability allows for unauthorized changes to course content, including the manipulation of sections and section items.

Reproduction

The vulnerability can be reproduced by sending an AJAX request to the 'catch_lp_ajax' function without the necessary authentication. This can be done by omitting the 'nonce' parameter or by not verifying the referer, which should match the site's domain.

Remediation

Users are advised to update the LearnPress WordPress LMS Plugin to version 4.3.2.1 or a newer patched version.