CVE-2024-11868 Overview
CVE-2024-11868 is a sensitive information exposure vulnerability in the LearnPress – WordPress LMS Plugin developed by Thimpress. The flaw affects all plugin versions up to and including 4.2.7.3 and resides in the class-lp-rest-material-controller.php file. Unauthenticated attackers can query the exposed REST endpoint to extract paid course material without purchasing or enrolling. The issue is classified under CWE-284: Improper Access Control.
Critical Impact
Unauthenticated remote attackers can retrieve paywalled course material through an improperly protected REST API endpoint, resulting in revenue loss and intellectual property exposure for site operators.
Affected Products
- LearnPress – WordPress LMS Plugin versions <= 4.2.7.3
- WordPress sites running the Thimpress LearnPress plugin
- Any e-learning site using LearnPress to gate paid course materials
Discovery Timeline
- 2024-12-10 - CVE-2024-11868 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11868
Vulnerability Analysis
The vulnerability is an information disclosure issue in the REST API surface exposed by LearnPress. The class-lp-rest-material-controller.php controller handles course material requests but does not correctly verify that the requester is authenticated or enrolled in the associated course.
An unauthenticated attacker can send crafted HTTP requests to the LearnPress materials endpoint and receive content that should be restricted to paying students. The impact is limited to confidentiality; integrity and availability are unaffected. The attack is executable over the network with low complexity and requires no user interaction.
This flaw sits in the category of broken access control on a public REST route, a common failure pattern in WordPress plugins that expose custom endpoints through register_rest_route().
Root Cause
The root cause is missing or insufficient permission checks in the REST controller responsible for serving course material. The permission_callback on the affected route does not enforce enrollment status or authentication, so any client can invoke the handler and receive protected data. See the WordPress plugin changeset for the code-level fix.
Attack Vector
An attacker sends HTTP requests directly to the LearnPress REST endpoint served under the WordPress REST API namespace. No credentials, tokens, or session cookies are required. The response returns course material that should be gated behind a purchase. For a full write-up of the request pattern, see the Abrahack research post and the Wordfence vulnerability entry.
No verified public exploit code is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-11868
Indicators of Compromise
- Unauthenticated HTTP requests to /wp-json/learnpress/v1/ routes referencing materials, especially from unfamiliar IP addresses
- Bursts of REST API requests iterating over sequential course or lesson identifiers
- Access log entries showing successful 200 responses for material endpoints without a preceding authenticated session
Detection Strategies
- Review web server and WordPress access logs for unauthenticated requests to LearnPress REST endpoints returning large response bodies
- Correlate high-volume material fetches with the absence of a login or checkout flow for the same client
- Deploy a Web Application Firewall (WAF) rule that flags anonymous access to LearnPress material routes
Monitoring Recommendations
- Enable verbose logging on the WordPress REST API and archive logs to a central store for retention and search
- Track LearnPress plugin version across sites and alert on any host running <= 4.2.7.3
- Monitor egress patterns from the web server for unusual bulk downloads of media associated with paid courses
How to Mitigate CVE-2024-11868
Immediate Actions Required
- Update the LearnPress – WordPress LMS Plugin to a version later than 4.2.7.3 on all affected sites
- Audit access logs for the LearnPress REST endpoints since the plugin was installed to determine whether course material was scraped
- Rotate any material tied to sensitive assessments or licensed third-party content that may have been exposed
Patch Information
Thimpress addressed the vulnerability in the LearnPress plugin update referenced by the WordPress plugin changeset 3200780. The fix adds proper permission enforcement in class-lp-rest-material-controller.php so that unauthenticated requests can no longer retrieve protected course material. Site administrators should upgrade through the WordPress plugin dashboard or via WP-CLI.
Workarounds
- Temporarily deactivate the LearnPress plugin on sites that cannot upgrade immediately, if course availability can be paused
- Add WAF or reverse-proxy rules that block anonymous access to the LearnPress materials REST route until patching is complete
- Restrict the WordPress REST API to authenticated users where feasible using a hardening plugin or custom filter on rest_authentication_errors
# Update LearnPress via WP-CLI to remediate CVE-2024-11868
wp plugin update learnpress
wp plugin get learnpress --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
