CVE-2023-6223

Summary

CVE-2023-6223 is a vulnerability affecting the LearnPress plugin for WordPress. This issue, present in versions up to 4.2.5.7, allows authenticated attackers with subscriber-level access or higher to retrieve the course progress details of other users. The vulnerability stems from a missing validation check on the 'userID' user-controlled key in the /wp-json/lp/v1/profile/course-tab REST API, making it an Insecure Direct Object Reference (IDOR) vulnerability. This weakness could potentially lead to unauthorized access to sensitive user information.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.