The WordPress LearnPress Plugin installed on the remote host is affected by multiple vulnerabilities :

 - A SQL injection vulnerability exists in the _get_items method of the LP_Modal_Search_Items class due to improper validation of user-supplied input. An authenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data. (CVE-2020-6010)

 - A privilege escalation vulnerability exists in the learn_press_accept_become_a_teacher function due to the code not checking the permissions of the requesting user. An unauthenticated, remote attacker can exploit this, via /wpadmin/, to gain 'teacher' access to the application. (CVE-2020-11511)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The WordPress LearnDash Plugin installed on the remote host is affected by a SQL Injection in the 'learndash_get_course_groups' function in the ld-groups.php file due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The WordPress LifterLMS Plugin installed on the remote host is affected by an arbitrary file write vulnerability that can allow the attackers to write and execute arbitrary PHP code on the server by changing their first name on their profile to PHP code.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The WordPress application running on the remote host has a version of the 'LifterLMS' plugin that is prior to 3.37.15 and, thus, is affected by an arbitrary file write vulnerability that can allow the attackers to write and execute arbitrary PHP code on the server by changing their first name on their profile to PHP code.

The WordPress application running on the remote host has a version of the 'LearnDash' plugin that is prior to 3.1.6 and, thus, is affected by a SQL Injection (SQLi) exists in the 'learndash_get_course_groups' function in the ld-groups.php file due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data.

The WordPress application running on the remote host has a version of the 'LearnPress' plugin that is prior to 3.2.6.8 and, thus, is affected by multiple vulnerabilities :

  - A SQL injection (SQLi) vulnerability exists in the _get_items method of the LP_Modal_Search_Items class     due to improper validation of user-supplied input. An authenticated, remote attacker can exploit this to     inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of     arbitrary data. (CVE-2020-6010)

  - A privilege escalation vulnerability exists in the learn_press_accept_become_a_teacher function due to the     code not checking the permissions of the requesting user. An unauthenticated, remote attacker can exploit     this, via /wpadmin/, to gain 'teacher' access to the application. (CVE-2020-11511)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
112388	LearnPress Plugin for WordPress < 3.2.6.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	5/14/2020	3/14/2023	high
112386	LearnDash Plugin for WordPress < 3.1.6 SQL Injection	Web App Scanning	Component Vulnerability	5/14/2020	3/14/2023	critical
112387	LifterLMS Plugin for WordPress < 3.37.15 Arbitrary File Write	Web App Scanning	Component Vulnerability	5/14/2020	3/14/2023	critical
136176	WordPress Plugin 'LifterLMS' < 3.37.15 Arbitrary File Write	Nessus	CGI abuses	4/30/2020	6/6/2024	critical
136286	WordPress Plugin 'LearnDash' < 3.1.6 SQLi	Nessus	CGI abuses	5/4/2020	6/6/2024	critical
136191	WordPress Plugin 'LearnPress' < 3.2.6.8 Multiple Vulnerabilities	Nessus	CGI abuses	5/1/2020	6/6/2024	high

Detections

Analytics

Plugins Search

high

critical

critical

critical

critical

high