CVE-2024-1289

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user controlled key when looking up order information. This makes it possible for authenticated attackers to obtain information on orders placed by other users and guests, which can be leveraged to sign up for paid courses that were purchased by guests. Emails of other users are also exposed.

• CWE-285
• CWE-639

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042945%40learnpress%2Ftags%2F4.2.6.3&new=3061851%40learnpress%2Ftags%2F4.2.6.4Broken Link
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0c410d91-08cc-496d-9c8e-c57f107399da?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042945%40learnpress%2Ftags%2F4.2.6.3&new=3061851%40learnpress%2Ftags%2F4.2.6.4Broken Link
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0c410d91-08cc-496d-9c8e-c57f107399da?source=cveThird Party Advisory

Published

Apr 9, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12881The PlugVersions – Easily rollback to previous versions of y…8.8
• CVE-2024-12882comfyanonymous/comfyui version v0.2.4 suffers from a non-bli…7.5
• CVE-2024-12883A vulnerability was found in code-projects Job Recruitment 1…6.1
• CVE-2024-12884A vulnerability was found in Codezips E-Commerce Website 1.0…9.8
• CVE-2024-12885The Connections Business Directory plugin for WordPress is v…6.5
• CVE-2024-12886An Out-Of-Memory (OOM) vulnerability exists in the `ollama` …7.5
• CVE-2024-12890A vulnerability was found in code-projects Online Exam Maste…8.8
• CVE-2024-12891A vulnerability classified as critical has been found in cod…8.8
• CVE-2024-12892A vulnerability classified as problematic was found in code-…5.4
• CVE-2024-12893A vulnerability, which was classified as problematic, has be…5.4
• CVE-2024-12894A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-12895A vulnerability has been found in TreasureHuntGame TreasureH…9.8