ThimPress LearnPress Sepay Payment Authentication Bypass Vulnerability

A broken authentication vulnerability has been identified in the ThimPress LearnPress Sepay Payment plugin, affecting versions through 4.0.0. This vulnerability allows authentication bypass, enabling unauthorized users to perform actions typically reserved for higher-privileged users, potentially leading to admin access on the website.

Impact

Exploitation of this vulnerability could allow an unauthorized user to gain administrative privileges on the WordPress site, enabling them to perform actions such as modifying content, managing plugins, or changing site settings.

Remediation

Users of the ThimPress LearnPress Sepay Payment plugin should update to version 4.0.1 or later. Patchstack users can enable auto-updates for vulnerable plugins.