CVE-2024-0377 Overview
CVE-2024-0377 affects the LifterLMS WordPress LMS Plugin for eLearning, a learning management system used to deliver courses on WordPress sites. The vulnerability results from a missing capability check on the process_review function in versions up to and including 7.5.1. Unauthenticated attackers can invoke the function over the network to publish an unrestricted number of reviews on affected sites. The flaw is classified under [CWE-284] Improper Access Control and [CWE-862] Missing Authorization. The vendor addressed the issue in version 7.5.2 via a code change to class.llms.review.php.
Critical Impact
Unauthenticated attackers can flood LifterLMS-powered course pages with arbitrary reviews, degrading content integrity and enabling spam or reputation-damage campaigns.
Affected Products
- LifterLMS WordPress LMS Plugin for eLearning, all versions up to and including 7.5.1
- Vendor: lifterlms
- Fixed release: LifterLMS 7.5.2
Discovery Timeline
- 2024-03-13 - CVE-2024-0377 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0377
Vulnerability Analysis
The vulnerability resides in the process_review function inside class.llms.review.php. The function processes incoming review submissions but does not verify that the requester holds the capability required to submit a review. Because no authorization check runs before the review is persisted, any HTTP client, including unauthenticated ones, can trigger the review workflow. Impact is limited to data integrity: attackers cannot read protected information or take the site offline. However, they can publish arbitrary review content in unlimited volume, which supports spam, defamation, and search-engine-manipulation use cases against course listings.
Root Cause
The root cause is a missing authorization check ([CWE-862]) combined with improper access control ([CWE-284]). LifterLMS exposes process_review through a WordPress action hook, but the handler omits both a current_user_can() capability verification and a nonce validation that would tie the request to an authenticated session. The vendor's fix in changeset 3036762 adds the missing gating logic before the review data is stored.
Attack Vector
Exploitation requires only network access to the WordPress site hosting a vulnerable LifterLMS installation. An attacker sends crafted HTTP POST requests to the endpoint that triggers process_review, supplying attacker-controlled review content and a target course identifier. No credentials, user interaction, or elevated privileges are required. Because the endpoint accepts repeated invocations, an attacker can script bulk submissions to publish arbitrary reviews at scale.
No public proof-of-concept exploit code is available. Technical details of the fix can be reviewed in the WordPress LifterLMS Changeset and the Wordfence Vulnerability Report.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-0377
Indicators of Compromise
- Unexpected volume of new reviews appearing on LifterLMS course pages, particularly from users with no prior enrollment history.
- Repeated POST requests to WordPress admin-ajax or LifterLMS review endpoints from a small set of source IPs.
- Reviews containing spam keywords, promotional URLs, or non-sequitur text tied to LifterLMS courses.
Detection Strategies
- Inventory WordPress deployments and enumerate installed LifterLMS versions; treat any instance at or below 7.5.1 as vulnerable.
- Review web server logs for anonymous POST traffic invoking review actions without an authenticated session cookie.
- Correlate new review database entries in the wp_comments table against authenticated login events to surface unauthenticated writes.
Monitoring Recommendations
- Alert on statistically abnormal spikes in review submission rate per course or per source IP.
- Forward WordPress and web-server access logs into a centralized analytics platform to enable retrospective hunting for process_review invocations.
- Enable WordPress application logging or a security plugin to record the author, IP, and referrer for every review submission.
How to Mitigate CVE-2024-0377
Immediate Actions Required
- Upgrade LifterLMS to version 7.5.2 or later on every WordPress site where the plugin is installed.
- Audit existing reviews created while running vulnerable versions and remove any illegitimate entries.
- Restrict access to WordPress admin-ajax endpoints from untrusted networks where operationally feasible.
Patch Information
The vendor fixed CVE-2024-0377 in LifterLMS 7.5.2. The patch adds the missing authorization check to the process_review function and is documented in the WordPress LifterLMS Changeset. Administrators should apply the update through the WordPress plugin manager or via automated update tooling.
Workarounds
- Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated POST requests targeting the LifterLMS review action.
- Temporarily disable the LifterLMS plugin on sites where upgrading is not immediately possible.
- Require login to view or submit reviews using a WordPress access-control plugin until the patched version is deployed.
# Configuration example: upgrade LifterLMS via WP-CLI
wp plugin update lifterlms --version=7.5.2
wp plugin list --name=lifterlms --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
