CVE-2024-6099

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in the 'check_validate_fields' function in the checkout. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.

• CWE-420

• https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.1/inc/class-lp-checkout.php#L124Product
• https://plugins.trac.wordpress.org/changeset/3109339/Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee714c7-4c9b-4627-9ba9-f83aeca6a0a5?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.1/inc/class-lp-checkout.php#L124Product
• https://plugins.trac.wordpress.org/changeset/3109339/Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee714c7-4c9b-4627-9ba9-f83aeca6a0a5?source=cveThird Party Advisory

Published

Jul 2, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6093Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-6094The WP ULike WordPress plugin before 4.7.1 does not sanitis…4.8
• CVE-2024-6095A vulnerability in the /models/apply endpoint of mudler/loca…5.8
• CVE-2024-6096In Progress® Telerik® Reporting versions prior to 18.1.24.70…9.8
• CVE-2024-6097In Progress® Telerik® Reporting versions prior to 2025 Q1 (1…5.3
• CVE-2024-6098When performing an online tag generation to devices which co…5.9
• CVE-2024-6100Type Confusion in V8 in Google Chrome prior to 126.0.6478.11…8.8
• CVE-2024-6101Inappropriate implementation in V8 in Google Chrome prior to…8.8
• CVE-2024-6102Out of bounds memory access in Dawn in Google Chrome prior t…8.8
• CVE-2024-6103Use after free in Dawn in Google Chrome prior to 126.0.6478.…8.8
• CVE-2024-6104go-retryablehttp prior to 0.7.7 did not sanitize urls when w…5.5
• CVE-2024-6105Rejected reason: This CVE ID has been rejected or withdrawn …