CVE-2024-1209 Scanner

LearnDash LMS is a learning management system plugin designed for WordPress, widely used by educators, instructors, and organizations to create and manage online courses. It allows users to upload various assignments and educational materials for learners to access and complete. LearnDash LMS serves as a comprehensive platform for delivering online education and training programs, offering features such as quizzes, assessments, and progress tracking.

The detected vulnerability in LearnDash LMS involves sensitive information exposure via assignments, present in versions prior to 4.10.2. Due to insufficient protection mechanisms, unauthenticated attackers can gain unauthorized access to uploaded assignment files by directly accessing them. This vulnerability poses a risk of exposing confidential educational materials and potentially sensitive information to unauthorized individuals.

The vulnerability manifests when unauthenticated attackers directly access assignment files uploaded via the '/wp-json/wp/v2/sfwd-assignment' endpoint of the WordPress site hosting the LearnDash LMS plugin. Attackers can identify and access assignment files by inspecting JSON responses containing assignment details, including file URLs. By manipulating the URL parameters, attackers can retrieve assignment files, potentially exposing sensitive information stored within them.

Exploiting the sensitive information exposure vulnerability in LearnDash LMS may lead to unauthorized disclosure of confidential educational materials, sensitive course content, and personal information of learners. Attackers can obtain access to assignment files containing sensitive data, such as student submissions, assessments, and instructor feedback, compromising the privacy and integrity of online learning environments.

Protect your online learning environment from the risks posed by the sensitive information exposure vulnerability in LearnDash LMS by leveraging the comprehensive security scanning capabilities of the S4E platform. Join our platform to detect and remediate critical vulnerabilities like CVE-2024-1209, ensuring the confidentiality and integrity of your educational materials and safeguarding the privacy of learners enrolled in your online courses.

References

• https://wpscan.com/vulnerability/f813a21d-7a6a-4ff4-a43c-3e2991a23c7f/
• https://github.com/karlemilnikka/CVE-2024-1209
• https://nvd.nist.gov/vuln/detail/CVE-2024-1209