CVE-2024-5648

The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e. wrld_set_configuration, wrld_exclude_settings_save, apply_time_tracking_settings, wp_ajax_wrld_gutenberg_block_visit, etc..) in all versions up to, and including, 1.8.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to update various plugin settings.

• CWE-862

• https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L261
• https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L284
• https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L423
• https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L455
• https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L52
• https://plugins.trac.wordpress.org/changeset/3119784/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7fbbd0d7-882f-4bc8-a67a-4d6dc05cb796?source=cve
• https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L261
• https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L284
• https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L423
• https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L455
• https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L52
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7fbbd0d7-882f-4bc8-a67a-4d6dc05cb796?source=cve

Published

Jul 9, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-56472IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to…5.4
• CVE-2024-56473IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an a…5.3
• CVE-2024-56474IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable t…8.8
• CVE-2024-56475IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable t…5.4
• CVE-2024-56476IBM TXSeries for Multiplatforms 9.1 and 11.1 could allow an …5.3
• CVE-2024-56477IBM Power Hardware Management Console V10.3.1050.0 could all…6.5
• CVE-2024-5649The Universal Slider plugin for WordPress is vulnerable to P…8.8
• CVE-2024-56493IBM EntireX 11.1 could allow a local user to obtain sensitiv…3.3
• CVE-2024-56494IBM EntireX 11.1 could allow a local user to obtain sensitiv…3.3
• CVE-2024-56495IBM EntireX 11.1 could allow a local user to obtain sensitiv…3.3
• CVE-2024-56496IBM EntireX 11.1 could allow a local user to obtain sensitiv…3.3
• CVE-2024-56497An improper neutralization of special elements used in an os…6.7