CVE-2024-1210: LearnDash LMS Information Disclosure Flaw

CVE-2024-1210 Overview

CVE-2024-1210 is an information disclosure vulnerability in the LearnDash LMS plugin for WordPress. The flaw exists in all versions up to and including 4.10.1 and affects an application programming interface (API) endpoint. Unauthenticated remote attackers can query the exposed API to obtain quiz content that should be restricted to enrolled learners.

The issue is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. LearnDash is widely deployed by educational platforms, corporate training programs, and membership sites, giving this exposure meaningful business impact for content owners.

Critical Impact
Unauthenticated attackers can retrieve quiz data over the network without user interaction, enabling assessment leakage and integrity loss for gated learning content.

Affected Products

LearnDash LMS plugin for WordPress, all versions up to and including 4.10.1
WordPress sites exposing the LearnDash REST API endpoints
Learning platforms relying on LearnDash for gated quiz delivery

Discovery Timeline

2024-02-05 - CVE-2024-1210 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1210

Vulnerability Analysis

The vulnerability resides in a LearnDash REST API route that returns quiz data without enforcing authentication or enrollment checks. An attacker sends unauthenticated HTTP requests to the affected endpoint and receives quiz content in the response. No credentials, tokens, or user interaction are required to reach the vulnerable code path.

The impact is confidentiality only. Integrity and availability of the WordPress site remain intact, but the confidentiality of quiz questions, answer keys, and related assessment metadata is broken. For customers monetizing courses or issuing certifications, exposure of quiz content undermines assessment validity.

The Exploit Prediction Scoring System (EPSS) probability is elevated relative to the median CVE, indicating measurable attention from opportunistic scanners. No public entry currently exists in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is a missing authorization check on a LearnDash API handler. The route registers a public callback that queries quiz records from the WordPress database and serializes them into the API response. The handler does not verify the current_user_can capability, membership in an enrolled course, or a valid nonce before returning results.

Attack Vector

Exploitation occurs over the network against any WordPress site running LearnDash <= 4.10.1. An attacker enumerates the plugin's REST endpoints and issues GET requests to the vulnerable route. The server returns quiz objects that the attacker parses to reconstruct assessment content. A public proof-of-concept is published in the karlemilnikka GitHub repository covering CVE-2024-1208 and CVE-2024-1210.

See the Wordfence Vulnerability Report for additional technical context on the exposed endpoint behavior.

Detection Methods for CVE-2024-1210

Indicators of Compromise

Unauthenticated HTTP GET requests to LearnDash REST routes under /wp-json/ldlms/ originating from unfamiliar IP addresses
High-volume enumeration of quiz identifiers within a short time window from a single source
Requests referencing quiz endpoints with no accompanying WordPress session cookie or nonce header

Detection Strategies

Review WordPress access logs and web application firewall (WAF) telemetry for anonymous requests to LearnDash wp-json endpoints returning HTTP 200 responses with sizable JSON payloads.
Correlate outbound scraping patterns with user-agent strings commonly used by vulnerability scanners and content-harvesting bots.
Baseline legitimate LearnDash API consumers and alert on deviations, particularly requests lacking authentication headers.

Monitoring Recommendations

Ingest WordPress and reverse-proxy logs into a centralized analytics platform to run queries for anomalous access to LearnDash routes.
Enable per-endpoint rate limiting on the LearnDash REST API and alert on threshold breaches.
Track plugin inventory across managed WordPress hosts to identify sites still running LearnDash <= 4.10.1.

How to Mitigate CVE-2024-1210

Immediate Actions Required

Upgrade LearnDash LMS to a version later than 4.10.1 on every affected WordPress site.
Audit web server logs for prior unauthenticated access to LearnDash quiz endpoints and rotate any quiz content that must remain confidential.
Restrict access to /wp-json/ from untrusted sources at the WAF or reverse proxy while patching is scheduled.

Patch Information

LearnDash addressed the vulnerability in a release following 4.10.1. Review the LearnDash Release Notes to confirm the fixed version and apply the update through the WordPress plugin manager or the vendor's automated update channel.

Workarounds

Block or authenticate requests to the affected LearnDash REST routes at the WAF layer until the patched plugin version is deployed.
Disable the WordPress REST API for unauthenticated users where compatible with site functionality.
Regenerate quiz questions and answers that may have been scraped prior to patching to preserve assessment integrity.

bash

# Example WAF rule concept: block unauthenticated LearnDash quiz API access
# Deny GET requests to LearnDash quiz endpoints when no auth cookie is present
location ~* /wp-json/ldlms/.*/(quizzes|sfwd-quiz) {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}