CVE-2025-11372 (GCVE-0-2025-11372)

Vulnerability from cvelistv5 – Published: 2025-10-18 06:42 – Updated: 2025-10-20 18:29
VLAI?
Summary
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin Tools REST endpoints which are registered with permission_callback set to __return_true. This makes it possible for unauthenticated attackers to perform destructive database operations including dropping indexes on any table (including WordPress core tables like wp_options), creating duplicate configuration entries, and degrading site performance via the /wp-json/lp/v1/admin/tools/create-indexs endpoint granted they can provide table names.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE
Assigner
References
Impacted products
Vendor Product Version
thimpress LearnPress – WordPress LMS Plugin Affected: * , ≤ 4.2.9.3 (semver)
Create a notification for this product.
Credits
Lucas Montes
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11372",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-20T18:26:35.513549Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-20T18:29:53.404Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.2.9.3",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lucas Montes"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin Tools REST endpoints which are registered with permission_callback set to __return_true. This makes it possible for unauthenticated attackers to perform destructive database operations including dropping indexes on any table (including WordPress core tables like wp_options), creating duplicate configuration entries, and degrading site performance via the /wp-json/lp/v1/admin/tools/create-indexs endpoint granted they can provide table names."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-18T06:42:48.790Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2365e92-d70d-47fa-9abe-7cbdd6336f39?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L30"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L101"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L145"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Databases/class-lp-db.php#L291"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Databases/class-lp-db.php#L316"
        },
        {
          "url": "https://github.com/LearnPress/learnpress/commit/cf940a437539a803e49136bdff7a53e1f2b2ca44"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-07T03:33:05.000+00:00",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-10-17T18:38:36.000+00:00",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u2013 WordPress LMS Plugin \u003c= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-11372",
    "datePublished": "2025-10-18T06:42:48.790Z",
    "dateReserved": "2025-10-06T14:44:39.048Z",
    "dateUpdated": "2025-10-20T18:29:53.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-11372\",\"sourceIdentifier\":\"security@wordfence.com\",\"published\":\"2025-10-18T07:15:34.837\",\"lastModified\":\"2025-10-21T19:31:25.450\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The LearnPress \u2013 WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin Tools REST endpoints which are registered with permission_callback set to __return_true. This makes it possible for unauthenticated attackers to perform destructive database operations including dropping indexes on any table (including WordPress core tables like wp_options), creating duplicate configuration entries, and degrading site performance via the /wp-json/lp/v1/admin/tools/create-indexs endpoint granted they can provide table names.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@wordfence.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"security@wordfence.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/LearnPress/learnpress/commit/cf940a437539a803e49136bdff7a53e1f2b2ca44\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Databases/class-lp-db.php#L291\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Databases/class-lp-db.php#L316\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L101\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L145\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L30\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2365e92-d70d-47fa-9abe-7cbdd6336f39?source=cve\",\"source\":\"security@wordfence.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-11372\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-20T18:26:35.513549Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-20T18:29:42.433Z\"}}], \"cna\": {\"title\": \"LearnPress \\u2013 WordPress LMS Plugin \u003c= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Lucas Montes\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L\"}}], \"affected\": [{\"vendor\": \"thimpress\", \"product\": \"LearnPress \\u2013 WordPress LMS Plugin\", \"versions\": [{\"status\": \"affected\", \"version\": \"*\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.2.9.3\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-10-07T03:33:05.000+00:00\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2025-10-17T18:38:36.000+00:00\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2365e92-d70d-47fa-9abe-7cbdd6336f39?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L30\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L101\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L145\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Databases/class-lp-db.php#L291\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Databases/class-lp-db.php#L316\"}, {\"url\": \"https://github.com/LearnPress/learnpress/commit/cf940a437539a803e49136bdff7a53e1f2b2ca44\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The LearnPress \\u2013 WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin Tools REST endpoints which are registered with permission_callback set to __return_true. This makes it possible for unauthenticated attackers to perform destructive database operations including dropping indexes on any table (including WordPress core tables like wp_options), creating duplicate configuration entries, and degrading site performance via the /wp-json/lp/v1/admin/tools/create-indexs endpoint granted they can provide table names.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2025-10-18T06:42:48.790Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-11372\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-20T18:29:53.404Z\", \"dateReserved\": \"2025-10-06T14:44:39.048Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2025-10-18T06:42:48.790Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.