CVE-2024-11868 is a vulnerability identified in the LearnPress plugin for WordPress, a widely used Learning Management System (LMS) plugin. The issue stems from improper access control (CWE-284) in the REST API endpoint implemented in class-lp-rest-material-controller.php. Specifically, the plugin fails to adequately restrict access to paid course materials, allowing unauthenticated attackers to retrieve sensitive content intended only for paying users. This exposure occurs because the REST controller does not enforce authentication or authorization checks before serving course materials. The vulnerability affects all versions up to and including 4.2.7.3. The CVSS v3.1 base score is 5.3, reflecting a medium severity level, with the vector indicating network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and limited confidentiality impact (C:L). There is no impact on integrity or availability. No patches or fixes are currently linked, and no active exploitation has been reported. However, the exposure of paid content can lead to revenue loss and intellectual property theft for course providers using the plugin.

The primary impact of this vulnerability is the unauthorized disclosure of paid course materials, which can lead to significant financial losses for educational content creators and organizations relying on LearnPress for monetized e-learning. Confidentiality is compromised as sensitive instructional content is exposed without authentication. While the vulnerability does not affect data integrity or system availability, the leakage of proprietary educational content can damage brand reputation and reduce customer trust. Additionally, widespread exploitation could undermine the business model of LMS providers using this plugin. Since the vulnerability is exploitable remotely without authentication or user interaction, the attack surface is broad, potentially affecting any publicly accessible WordPress site running vulnerable versions of LearnPress. This risk is heightened for organizations with valuable or exclusive course content.

To mitigate this vulnerability, organizations should immediately upgrade LearnPress to a patched version once available from the vendor. In the absence of an official patch, administrators should implement strict access controls on REST API endpoints, restricting access to authenticated and authorized users only. This can be achieved by customizing the plugin code to enforce authentication checks in class-lp-rest-material-controller.php or by using WordPress security plugins that limit REST API access. Additionally, monitoring web server logs for unusual access patterns to course material endpoints can help detect exploitation attempts. Organizations should also review and tighten permissions for user roles within WordPress to minimize unauthorized data exposure. Regular backups and security audits of LMS installations are recommended to ensure integrity and timely detection of vulnerabilities.