CyberRota Analysis
AI-GeneratedThe LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options due to insufficient validation in the learnpress_create_page AJAX action, affecting versions up to 4.4.4. This flaw allows authenticated attackers with Editor-level access to manipulate critical site settings, potentially leading to unauthorized public registration, site disruption, or other malicious configurations. WordPress site administrators and users of the LearnPress plugin should prioritize this vulnerability to prevent potential exploitation.
Original NVD Description
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.