CVE-2023-6223
Last modified
CVE-2023-6223 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the details of another user's course progress.. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the details of another user's course progress.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Thimpress | Learnpress | <= 4.2.5.7 |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/215d5d9e-dabb-462d-8c51-952f8c497b78?source=cveProduct, Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/215d5d9e-dabb-462d-8c51-952f8c497b78?source=cveProduct, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-6223?
How severe is CVE-2023-6223?
How do I fix CVE-2023-6223?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-6217 In Progress MOVEit Transfer versions released before 2022.0…6.1
- CVE-2023-6218 In Progress MOVEit Transfer versions released before 2022.0…7.2
- CVE-2023-6219The BookingPress plugin for WordPress is vulnerable to arbit…7.2
- CVE-2023-6220The Piotnet Forms plugin for WordPress is vulnerable to arbi…9.8
- CVE-2023-6221 The cloud provider MachineSense uses for integration and de…6.5
- CVE-2023-6222IThe Quttera Web Malware Scanner WordPress plugin before 3.4…7.2
- CVE-2023-6225The WP Shortcodes Plugin — Shortcodes Ultimate plugin for Wo…5.4
- CVE-2023-6226The WP Shortcodes Plugin — Shortcodes Ultimate plugin for Wo…4.3
- CVE-2023-6228An issue was found in the tiffcp utility distributed by the …3.3
- CVE-2023-6229Buffer overflow in CPCA PDL Resource Download process of Off…9.8
- CVE-2023-6230Buffer overflow in the Address Book password process in auth…9.8
- CVE-2023-6231Buffer overflow in WSD probe request process of Office Multi…9.8
Are you affected by CVE-2023-6223?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST