CVE-2024-12172: WP Courses LMS Auth Bypass Vulnerability

CVE-2024-12172 Overview

CVE-2024-12172 affects the WP Courses LMS plugin for WordPress, an online courses builder used for eLearning and education delivery. The plugin contains a missing capability check on the wpc_update_user_meta_option() function in all versions up to and including 3.2.21. Authenticated attackers with Subscriber-level access or higher can update arbitrary user metadata. By setting wp_capabilities to 0, an attacker can lock administrators out of their own site. The flaw is categorized under [CWE-862] Missing Authorization.

Critical Impact
Authenticated Subscriber-level attackers can modify any user's metadata, including overwriting wp_capabilities to deny administrators access to their WordPress site.

Affected Products

WP Courses LMS – Online Courses Builder plugin for WordPress
All versions up to and including 3.2.21
WordPress sites with Subscriber-level registration enabled

Discovery Timeline

2024-12-12 - CVE-2024-12172 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-12172

Vulnerability Analysis

The WP Courses LMS plugin exposes the wpc_update_user_meta_option() function without performing a capability check against the requesting user. The function updates user metadata in the WordPress database but does not verify whether the caller has authority to modify the targeted user record. Any authenticated session, including a low-privileged Subscriber, can invoke the function and write metadata to arbitrary user IDs.

The impact centers on integrity rather than data confidentiality. By targeting the wp_capabilities meta key, an attacker can overwrite role assignments stored in the database. Setting wp_capabilities to 0 invalidates the serialized role array WordPress expects, which strips the targeted user of all role-based access rights. Administrators affected by this change cannot log in to manage the site.

Root Cause

The root cause is the absence of a current_user_can() check or an equivalent authorization gate inside wpc_update_user_meta_option(). The function trusts request parameters that specify the target user and metadata fields. Authentication alone is treated as sufficient to authorize the write, violating the principle of least privilege.

Attack Vector

Exploitation requires network access to the WordPress site and a valid Subscriber account, which is often obtainable through self-service registration. The attacker submits a request to the vulnerable AJAX or admin endpoint that invokes wpc_update_user_meta_option(), supplying a target user ID and a manipulated wp_capabilities value. Refer to the Wordfence Vulnerability Intelligence advisory and the WordPress Plugin Changeset for technical details on the affected function path.

Detection Methods for CVE-2024-12172

Indicators of Compromise

Unexpected modifications to the wp_usermeta table where meta_key equals wp_capabilities, particularly values of 0 or empty serialized arrays.
Administrator accounts suddenly unable to log in or access the WordPress admin dashboard.
POST requests from Subscriber-level sessions to plugin endpoints invoking wpc_update_user_meta_option.

Detection Strategies

Audit recent changes to the wp_usermeta table and correlate timestamps with plugin request logs.
Monitor WordPress access logs for requests to admin-ajax.php or REST endpoints associated with the WP Courses plugin originating from low-privileged accounts.
Enumerate all users and verify the integrity of stored wp_capabilities values against expected role assignments.

Monitoring Recommendations

Enable a WordPress security plugin or web application firewall (WAF) to log AJAX actions tied to the WP Courses LMS plugin.
Alert on any administrator role change or capability reset, especially events not initiated through the standard user management UI.
Track new Subscriber registrations and review their session activity for suspicious metadata write attempts.

How to Mitigate CVE-2024-12172

Immediate Actions Required

Update the WP Courses LMS plugin to a version newer than 3.2.21 that includes the capability check fix referenced in the WordPress Plugin Changeset.
Disable the plugin if a patched version cannot be deployed immediately and the site allows open user registration.
Review all user accounts and restore the correct wp_capabilities value for any administrator whose metadata was tampered with.

Patch Information

The vendor addressed the issue in the WP Courses LMS plugin code repository. The fix adds an authorization check to wpc_update_user_meta_option() so that only users with the required capability can update metadata. Site operators should apply the latest available release through the WordPress plugin updater and confirm the installed version is greater than 3.2.21.

Workarounds

Restrict new user registration or set the default role to a non-functional placeholder until the plugin is updated.
Deploy a WAF rule that blocks unauthenticated and Subscriber-level requests targeting the wpc_update_user_meta_option action.
Back up the wp_usermeta table on a frequent schedule to enable rapid recovery of administrator capabilities if tampering occurs.

bash

# Verify and restore administrator capabilities via WP-CLI
wp user list --role=administrator --fields=ID,user_login
wp user set-role <user_id> administrator