CVE-2024-5648

MEDIUM

LearnDash LMS - Reports <1.8.2 - Info Disclosure

Title source: llm

Description

The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e. wrld_set_configuration, wrld_exclude_settings_save, apply_time_tracking_settings, wp_ajax_wrld_gutenberg_block_visit, etc..) in all versions up to, and including, 1.8.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to update various plugin settings.

References (7)

Core 7

Core References

Product

https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L261

Product

https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L284

Product

https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L423

Product

https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L455

Product

https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L52

https://plugins.trac.wordpress.org/changeset/3119784/

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/7fbbd0d7-882f-4bc8-a67a-4d6dc05cb796?source=cve

Scores

CVSS v3 5.4

EPSS 0.0045

EPSS Percentile 36.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

stellarwp/LearnDash LMS – Reports < 1.8.2

stellarwp/LearnDash LMS – Reports < 1.8.2.1

Published Jul 09, 2024

Tracked Since Feb 18, 2026