8.1
Élevée
CVE-2022-3360 The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to…
Description
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution (RCE). To successfully exploit this vulnerability attackers must have knowledge of the site secrets, allowing them to generate a valid hash via the wp_hash() function.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| LearnPress – WordPress LMS Plugin 4.1 | premières → < 4.1.7.2 | 4.1.7.2 |
Autres CVE de LearnPress – WordPress LMS Plugin
Les 4 CVE de LearnPress – WordPress LMS Plugin →
CVE-2022-0271
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it…
Non notée
CVE-2021-24951
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it…
Non notée
CVE-2021-24702
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course…
Non notée