CVE-2024-39641: Thimpress LearnPress CSRF Vulnerability

CVE-2024-39641 Overview

CVE-2024-39641 is a Cross-Site Request Forgery (CSRF) vulnerability in the ThimPress LearnPress plugin for WordPress. The flaw affects all versions up to and including 4.2.6.8.2. LearnPress is a learning management system (LMS) plugin used by WordPress sites to deliver online courses, making affected installations common across education and training platforms.

The vulnerability is categorized under [CWE-352] (Cross-Site Request Forgery) and stems from missing or insufficient anti-CSRF token validation on state-changing requests. An attacker who tricks an authenticated user into visiting a malicious page can cause the victim's browser to issue unwanted requests to the LearnPress backend.

Critical Impact

A successful attack can compromise confidentiality, integrity, and availability of the LearnPress installation by performing privileged actions in the context of the targeted user.

Affected Products

• ThimPress LearnPress for WordPress, all versions through 4.2.6.8.2
• WordPress sites running the vulnerable LearnPress plugin
• LMS deployments built on top of LearnPress (course catalog, enrollment, payment flows)

Discovery Timeline

• 2024-08-26 - CVE-2024-39641 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39641

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery flaw in the LearnPress WordPress plugin. CSRF abuses the trust a web application places in a user's authenticated session. When the application fails to verify that a state-changing request originated from a legitimate user-initiated action, an attacker-controlled page can issue requests on the victim's behalf.

Exploitation requires user interaction, typically by luring an authenticated LearnPress user, often an administrator or instructor, to a crafted page. Once the victim loads the malicious content, their browser automatically sends authenticated requests to the LearnPress endpoint, allowing the attacker to trigger administrative or instructor-level actions.

Because the attack runs in the authenticated session, the resulting actions inherit the victim's privileges. The impact spans confidentiality, integrity, and availability of LearnPress data and configuration.

Root Cause

The root cause is missing or improperly validated CSRF protections on sensitive LearnPress request handlers. WordPress provides nonce mechanisms such as wp_nonce_field() and check_admin_referer(), but affected versions do not enforce these checks consistently across all state-changing actions in LearnPress through 4.2.6.8.2.

Attack Vector

The attack vector is network-based and requires user interaction. The attacker hosts a malicious page containing a hidden form or JavaScript that auto-submits a forged request to the vulnerable LearnPress endpoint. If the victim is authenticated to the WordPress site at the time of the visit, the browser attaches the session cookies and the request is processed as legitimate.

The vulnerability mechanism is described in the Patchstack CSRF Vulnerability Advisory. No verified public exploit code is currently associated with this CVE.

Detection Methods for CVE-2024-39641

Indicators of Compromise

• Unexpected administrative or instructor actions in LearnPress audit logs that do not correlate with legitimate user activity.
• HTTP Referer headers on LearnPress POST requests pointing to external or unfamiliar domains.
• Spikes in LearnPress AJAX or admin-post endpoint requests from sessions immediately after users visit untrusted URLs.

Detection Strategies

• Inspect WordPress access logs for state-changing requests to LearnPress endpoints (admin-ajax.php, admin-post.php, plugin REST routes) lacking valid nonce parameters.
• Correlate authenticated session activity with browser referer data to identify cross-origin requests against LearnPress.
• Deploy a web application firewall (WAF) rule that flags POST requests to LearnPress endpoints missing the expected _wpnonce token.

Monitoring Recommendations

• Forward WordPress and webserver logs into a centralized analytics platform such as Singularity Data Lake for correlation across users, sessions, and request origins.
• Alert on privileged LearnPress configuration changes, course modifications, and user role updates outside of normal administrative windows.
• Monitor endpoints used by LearnPress administrators for browser-borne attacks using behavioral protection such as Singularity Endpoint.

How to Mitigate CVE-2024-39641

Immediate Actions Required

• Update ThimPress LearnPress to a version released after 4.2.6.8.2 that addresses this CSRF flaw.
• Audit recent LearnPress administrative actions to identify any unauthorized changes performed during the exposure window.
• Require LearnPress administrators and instructors to log out of WordPress sessions when not actively managing the site.

Patch Information

Users should upgrade LearnPress to the latest version available from the WordPress plugin repository or ThimPress. Refer to the Patchstack CSRF Vulnerability Advisory for the fixed version range and remediation guidance.

Workarounds

• Restrict access to /wp-admin by IP allowlist so only trusted networks can reach LearnPress administrative endpoints.
• Deploy a WAF rule that blocks POST requests to LearnPress endpoints when the Referer or Origin header does not match the site domain.
• Enforce SameSite=Lax or SameSite=Strict on WordPress authentication cookies to reduce cross-site request execution.
• Educate LearnPress administrators to avoid clicking untrusted links while logged into the WordPress dashboard.

# Example WAF rule (ModSecurity) blocking cross-origin POSTs to LearnPress endpoints
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1004039641,phase:2,deny,status:403,log,msg:'Possible CSRF against LearnPress (CVE-2024-39641)'"
  SecRule REQUEST_URI "@rx /(wp-admin/admin-(ajax|post)\.php|wp-json/lp/)" "chain"
  SecRule REQUEST_HEADERS:Origin "!@rx ^https?://(www\.)?example\.com$"