CVE-2024-1208: LearnDash LMS Information Disclosure Flaw

CVE-2024-1208 Overview

The LearnDash LMS plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 4.10.2. The flaw resides in an API endpoint that fails to enforce access controls on quiz question data. Unauthenticated attackers can query the API to retrieve quiz questions from the WordPress site.

The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. It affects a widely deployed learning management system used by educational institutions and enterprises for course delivery and assessments.

Critical Impact
Unauthenticated remote attackers can extract quiz questions from any vulnerable LearnDash instance, undermining assessment integrity across educational and corporate training environments.

Affected Products

LearnDash LMS plugin for WordPress, all versions up to and including 4.10.2
WordPress installations with LearnDash quiz functionality enabled
Educational and corporate training sites relying on LearnDash assessments

Discovery Timeline

2024-02-05 - CVE-2024-1208 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1208

Vulnerability Analysis

The vulnerability affects the LearnDash LMS plugin API surface. The affected endpoint returns quiz question content without validating whether the caller is authenticated or authorized to access the underlying course material. Attackers reach the endpoint over the network without user interaction.

Quiz questions are typically gated behind course enrollment, payment, or instructor-managed access. The exposure breaks that trust boundary. Attackers can enumerate quiz identifiers and pull the question set for any quiz stored by the plugin.

The practical impact varies by deployment. Certification programs, academic exams, and paid course assessments lose integrity when questions circulate outside the intended audience. Confidentiality of assessment content is compromised; integrity and availability of the WordPress host are not affected.

For full technical detail, review the Wordfence Vulnerability Report and the public proof-of-concept repository.

Root Cause

The root cause is missing authorization on a REST API route that exposes quiz question data. The plugin registered the endpoint without a capability check or permission callback that verifies course enrollment before returning question content.

Attack Vector

An attacker sends unauthenticated HTTP requests to the vulnerable LearnDash API endpoint on a target WordPress site. The endpoint responds with quiz question data that should only be accessible to enrolled learners or site administrators. No credentials, tokens, or user interaction are required. Refer to the public proof-of-concept repository for request-level detail.

Detection Methods for CVE-2024-1208

Indicators of Compromise

Unauthenticated HTTP requests to LearnDash REST API routes handling quiz content, particularly from unfamiliar IP addresses or automated user agents.
High-volume enumeration patterns iterating through quiz or question identifiers over short time windows.
Access log entries showing successful 200 OK responses to LearnDash API endpoints from clients that never authenticated to WordPress.

Detection Strategies

Review WordPress access logs for requests to /wp-json/ paths associated with the LearnDash plugin returning quiz data to unauthenticated sessions.
Correlate request volume against known enrolled user activity to surface anomalous quiz question retrieval.
Deploy web application firewall rules that flag or block unauthenticated calls to LearnDash quiz-related API endpoints.

Monitoring Recommendations

Enable verbose HTTP access logging on the WordPress host and forward logs to a centralized analytics or SIEM platform for retention and search.
Alert on spikes in outbound response bytes from LearnDash API routes, which can indicate bulk question extraction.
Track the installed LearnDash version across all WordPress sites in inventory and alert when any instance runs 4.10.2 or earlier.

How to Mitigate CVE-2024-1208

Immediate Actions Required

Upgrade the LearnDash LMS plugin to a version later than 4.10.2 as published in the LearnDash Release Notes.
Audit WordPress access logs for prior unauthenticated requests to LearnDash API endpoints and assess whether quiz content was exfiltrated.
Rotate or replace quiz question banks used for high-stakes assessments if exposure is confirmed.

Patch Information

LearnDash addressed the issue in a release subsequent to 4.10.2. Consult the official LearnDash Release Notes to identify the fixed version and apply the update through the WordPress plugin manager or by deploying the vendor-supplied package.

Workarounds

Restrict access to LearnDash REST API routes at the web server or WAF layer, permitting only authenticated sessions with valid WordPress cookies.
Temporarily disable public quiz functionality on affected sites until the patched plugin version is deployed.
Apply IP allowlisting on /wp-json/ endpoints where the user population is known and limited.

bash

# Example Nginx rule restricting unauthenticated access to LearnDash API routes
location ~ ^/wp-json/ldlms/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 401;
    }
}