The LearnPress WordPress LMS Plugin (versions up to 4.0.0) contains a CSRF vulnerability due to improper or missing nonce validation on the filter_users function. This flaw enables unauthenticated attackers to escalate their privileges to teacher level by exploiting the trust relationship with an administrator who performs a crafted action, such as clicking a malicious link. The vulnerability is tracked as CVE-2024-2115 with a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to elevate privileges to teacher level within the LearnPress plugin, potentially enabling unauthorized course management and content manipulation. This compromises the integrity and confidentiality of the LMS environment and could disrupt availability. The high CVSS score (8.8) reflects the critical nature of this privilege escalation via CSRF.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid performing untrusted actions or clicking unknown links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security channels is recommended to apply any forthcoming patches promptly.