CVE-2024-6099 is an unprotected alternate channel vulnerability (CWE-420) in the LearnPress WordPress LMS Plugin that allows unauthenticated attackers to bypass user registration controls. Specifically, the 'check_validate_fields' function in the checkout process lacks proper validation, permitting attackers to register accounts with the default role despite registration being disabled. This affects versions up to and including 4.2.6.8.1. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. No patch or official remediation guidance has been published by the vendor as of the data provided.

An attacker can create user accounts on a vulnerable LearnPress installation without authentication, bypassing any registration restrictions configured by the site administrator. This could allow unauthorized access with default user privileges, potentially enabling further abuse depending on the site's configuration and user role permissions. There is no indication of confidentiality, integrity, or availability impact beyond unauthorized user creation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor for updates from thimpress and consider restricting access to the registration functionality or disabling the LearnPress plugin if possible. No official patch or temporary fix is currently documented.