CVE-2024-56048: WPLMS Auth Bypass Vulnerability

CVE-2024-56048 Overview

CVE-2024-56048 is a Missing Authorization vulnerability [CWE-862] in the VibeThemes WPLMS wplms_plugin for WordPress. The flaw affects all versions up to and including 1.9.9. Authenticated attackers with low privileges can access functionality that is not properly constrained by Access Control Lists (ACLs). According to the Patchstack advisory, the weakness enables arbitrary option updates that lead to privilege escalation on the affected WordPress site.

Critical Impact
A low-privileged authenticated user can escalate privileges by updating arbitrary WordPress options, resulting in full site compromise across confidentiality, integrity, and availability.

Affected Products

VibeThemes WPLMS wplms_plugin versions up to and including 1.9.9
WordPress sites running the WPLMS Learning Management System plugin
Any deployment where low-privileged accounts (for example, students or subscribers) can register or authenticate

Discovery Timeline

2024-12-18 - CVE-2024-56048 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56048

Vulnerability Analysis

The WPLMS plugin exposes plugin actions that do not verify the caller's capability or role before executing sensitive operations. The Patchstack advisory categorizes the issue as an arbitrary option update leading to privilege escalation. An attacker who holds any authenticated session on the target WordPress site can invoke the affected handler and modify site-wide options.

By overwriting sensitive options such as default_role or users_can_register, the attacker converts the WordPress instance into a trust boundary they control. Newly registered accounts are provisioned as administrators, granting full control of the site, its content, and its underlying PHP execution environment.

Root Cause

The root cause is a missing authorization check [CWE-862] in one or more plugin request handlers. The handlers rely on the presence of an authenticated session but omit current_user_can() capability validation. WordPress option APIs invoked by the handler therefore execute with the effective privileges of the plugin, not those of the requesting user.

Attack Vector

Exploitation is remote and requires only low-privileged authentication. The attacker sends a crafted request to the vulnerable WPLMS endpoint, supplying attacker-controlled option names and values. Because no capability check gates the code path, the request succeeds. See the Patchstack advisory for CVE-2024-56048 for a full technical description.

No verified public proof-of-concept code is available. The vulnerability manifests when the plugin dispatches an AJAX or admin-post action without validating the caller's role prior to writing WordPress options.

Detection Methods for CVE-2024-56048

Indicators of Compromise

Unexpected changes to the wp_options table, particularly to default_role, users_can_register, siteurl, home, or admin_email
New WordPress accounts created with the administrator role shortly after WPLMS-related HTTP requests
POST requests to admin-ajax.php or admin-post.php referencing WPLMS actions from low-privileged session cookies

Detection Strategies

Compare current wp_options values against a known-good baseline and alert on drift for privilege-relevant keys
Enable WordPress audit logging (for example, via a security plugin) to record option changes with user attribution
Review web server access logs for authenticated requests to WPLMS action handlers followed by administrator account creation

Monitoring Recommendations

Alert on any change to default_role that sets it to administrator
Monitor for users_can_register transitioning from 0 to 1 outside change windows
Track new user creations correlated with WPLMS plugin activity in the same session

How to Mitigate CVE-2024-56048

Immediate Actions Required

Update WPLMS to a version later than 1.9.9 as soon as the vendor patch is available
Audit all administrator-level accounts and remove any that were not provisioned by a legitimate administrator
Reset credentials for administrator accounts and invalidate active sessions
Restore critical wp_options values (default_role, users_can_register) to their intended settings

Patch Information

Refer to the Patchstack advisory for the WPLMS arbitrary option update vulnerability for fixed version details. Apply the vendor-supplied update through the WordPress plugin management interface once released.

Workarounds

Deactivate the WPLMS plugin until a patched version is installed and verified
Restrict access to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php for WPLMS actions using a web application firewall rule
Disable open user registration by setting users_can_register to 0 and forcing default_role to subscriber

bash

# Configuration example: enforce safe WordPress defaults via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin deactivate wplms