The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_review' function in all versions up to, and including, 7.5.1. This makes it possible for unauthenticated attackers to publish an unrestricted number of reviews on the site.
CVSS
No CVSS.
References
Configurations
History
23 Jan 2025, 19:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/changeset/3036762/lifterlms/tags/7.5.2/includes/class.llms.review.php?old=2903997&old_path=lifterlms/trunk/includes/class.llms.review.php - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f41400-5c59-444d-9c1e-121e83449521?source=cve - Third Party Advisory | |
| First Time |
Lifterlms
Lifterlms lifterlms |
|
| CPE | cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-862 |
13 Mar 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-13 16:15
Updated : 2025-01-23 19:50
NVD link : CVE-2024-0377
Mitre link : CVE-2024-0377
JSON object : View
Products Affected
lifterlms
- lifterlms
CWE
CWE-862
Missing Authorization