CVE-2024-4397: Thimpress LearnPress RCE Vulnerability

CVE-2024-4397 Overview

CVE-2024-4397 is an arbitrary file upload vulnerability in the LearnPress WordPress LMS Plugin developed by ThimPress. The flaw resides in the save_post_materials function, which lacks proper file type validation. Authenticated users with Instructor-level permissions or above can upload arbitrary files to the affected site's server. Successful exploitation may lead to remote code execution on the underlying WordPress host. All versions of LearnPress up to and including 4.2.6.5 are affected. The vulnerability is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated Instructor-level attackers can upload arbitrary files and potentially achieve remote code execution on affected WordPress installations.

Affected Products

ThimPress LearnPress WordPress LMS Plugin versions up to and including 4.2.6.5
WordPress sites running the vulnerable plugin with Instructor-level user accounts
Any WordPress installation exposing the LearnPress material REST API endpoint

Discovery Timeline

2024-05-14 - CVE-2024-4397 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4397

Vulnerability Analysis

The vulnerability exists in the LearnPress REST API material controller, specifically in the save_post_materials function located in inc/rest-api/v1/frontend/class-lp-rest-material-controller.php. The endpoint accepts file uploads that instructors attach to course materials but does not validate the MIME type, extension, or contents of the uploaded file. As a result, an attacker with Instructor permissions can submit a PHP file, or another executable server-side file, through the material upload workflow.

Once the file is stored within the WordPress uploads directory, the attacker can request it directly through the web server. If the target environment executes PHP within the uploads path, the attacker gains remote code execution under the web server user context. Impact extends to full site compromise, database access, and potential lateral movement across shared hosting environments.

Root Cause

The root cause is missing file type validation in the save_post_materials handler. The function trusts the file supplied by an authenticated instructor and writes it to disk without enforcing an allow-list of safe extensions or verifying MIME type. This design assumes instructor accounts are trustworthy, which does not hold in multi-tenant learning platforms where instructor registration may be self-service.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated account with Instructor-level privileges or higher. The attacker sends a crafted request to the LearnPress material REST API endpoint, attaching a malicious file such as a PHP web shell. After the file is stored under wp-content/uploads/, the attacker requests it directly through HTTP to trigger code execution. No user interaction from an administrator is required. Refer to the WordPress LearnPress Code Reference for the vulnerable code path and the Wordfence Vulnerability Analysis for further technical detail.

Detection Methods for CVE-2024-4397

Indicators of Compromise

Unexpected files with executable extensions such as .php, .phtml, or .phar inside wp-content/uploads/ directories associated with LearnPress course materials
POST requests to LearnPress REST API endpoints under /wp-json/lp/v1/material/ from instructor accounts uploading non-document file types
New or modified files in the uploads directory with recent timestamps that do not match expected course material types (PDF, DOCX, images)
Outbound network connections initiated by the PHP-FPM or web server process shortly after a material upload event

Detection Strategies

Inspect web server access logs for POST requests to the LearnPress material controller endpoint followed by GET requests to files with executable extensions in the uploads path
Audit the WordPress wp_posts and wp_postmeta tables for material attachments referencing suspicious file extensions
Monitor for creation of files with server-executable extensions in any WordPress uploads directory using file integrity monitoring

Monitoring Recommendations

Enable process telemetry on WordPress hosts to alert on PHP interpreter execution originating from files inside wp-content/uploads/
Log and review all Instructor-level account creations and role changes in WordPress
Track REST API activity volume per instructor account to detect anomalous upload behavior

How to Mitigate CVE-2024-4397

Immediate Actions Required

Update the LearnPress plugin to a version later than 4.2.6.5 immediately, as tracked in the WordPress Changeset Update
Audit all existing Instructor-level accounts and remove any that are not required or appear suspicious
Scan the wp-content/uploads/ directory for unauthorized executable files and remove them
Rotate WordPress administrator and database credentials if evidence of exploitation is found

Patch Information

ThimPress addressed the vulnerability in LearnPress versions released after 4.2.6.5. The fix, documented in the WordPress Changeset Update, introduces file type validation within the save_post_materials function so that only permitted material formats can be written to the server. Administrators should update through the WordPress plugin manager or by replacing the plugin files with the patched release.

Workarounds

Restrict the ability to create Instructor accounts and require manual administrator approval for role elevation
Configure the web server to prevent execution of PHP and other server-side scripts within the wp-content/uploads/ directory using an .htaccess rule or equivalent Nginx location block
Deploy a web application firewall rule to block uploads of executable file extensions to the LearnPress material REST API endpoint
Temporarily disable the LearnPress plugin on sites that cannot be patched immediately

bash

# Apache configuration: block PHP execution in WordPress uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php5|php7)$">
    Require all denied
</FilesMatch>