CVE-2024-1289

Executive Summary

CVE-2024-1289 is an Insecure Direct Object Reference (IDOR) vulnerability in the LearnPress – WordPress LMS Plugin, affecting all versions up to and including 4.2.6.3. The vulnerability allows authenticated attackers to access order information belonging to other users and guests by manipulating a user-controlled key (likely an order ID) without proper validation. This exposure can lead to unauthorized access to paid course enrollments originally purchased by guests, as well as the disclosure of other users' email addresses. The vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx.

The CVSS score is 6.5 (Medium), with a low attack complexity and no user interaction required. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a patch makes it a significant risk for affected sites.

Supply Chain & Package Security

This vulnerability affects the LearnPress plugin distributed via the WordPress plugin repository. Since it is a WordPress plugin, it is not part of NPM, PyPI, Go, or Ruby ecosystems. However, site administrators should verify the integrity of the plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (exposure of order data and emails)
• Integrity Impact: None
• Availability Impact: None

The threat level is elevated due to the potential for data leakage and unauthorized access to paid courses. The lack of a patch increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability resides in the order lookup functionality of LearnPress. The plugin uses a user-controlled key (likely an order ID or similar parameter) to retrieve order details. Due to missing validation, an authenticated attacker can enumerate or manipulate this key to access orders belonging to other users or guests.

Technical Details:

• The vulnerable endpoint likely processes requests like /wp-json/learnpress/v1/orders/<id> or similar.
• The plugin fails to verify that the authenticated user is the owner of the order being accessed.
• This allows an attacker to:
  • View order details (including email addresses of other users).
  • Access paid course enrollments originally purchased by guests, potentially allowing the attacker to sign up for those courses without payment.

Attack Scenario:

1. Attacker authenticates to the WordPress site (e.g., as a subscriber).
2. Attacker sends a request to the LearnPress order endpoint with a manipulated order ID.
3. The server returns order details for a different user, including email and course enrollment data.
4. Attacker uses this information to enroll in paid courses or harvest email addresses.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is present in all versions up to 4.2.6.3. The fix would require adding authorization checks to ensure the requesting user owns the order or has appropriate permissions.

Vulnerable Code (Conceptual):

// In a LearnPress controller or API handler
function get_order_details($order_id) {
    $order = get_post($order_id);
    // No check if current user is the order owner
    return $order;
}

Patched Code (Conceptual):

function get_order_details($order_id) {
    $order = get_post($order_id);
    $user_id = get_current_user_id();
    // Check if user is admin or order owner
    if (current_user_can('manage_options') || $order->post_author == $user_id) {
        return $order;
    } else {
        return new WP_Error('forbidden', 'You do not have permission to view this order.');
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with LearnPress <= 4.2.6.3 installed.
• Authenticated user account (e.g., subscriber).

Exploitation Steps:

1. Log in to WordPress as an authenticated user.
2. Identify the order endpoint (e.g., via browser developer tools or by inspecting LearnPress API routes).
3. Send a GET request to the endpoint with a manipulated order ID:

   GET /wp-json/learnpress/v1/orders/123 HTTP/1.1
   Host: target-site.com
   Cookie: wordpress_logged_in_...
   

4. If the order ID belongs to another user, the response will contain their order details and email.

Example Request (using curl):

curl -X GET "https://target-site.com/wp-json/learnpress/v1/orders/123" \
  -H "Cookie: wordpress_logged_in_abc123"

Expected Response (truncated):

{
  "id": 123,
  "user_email": "victim@example.com",
  "course_id": 456,
  "status": "completed"
}

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual patterns in order API requests, especially from low-privileged users.
• Look for rapid enumeration of order IDs (e.g., sequential IDs).
• Alert on access to order endpoints by users who are not administrators.

Hardening:

• Implement a Web Application Firewall (WAF) rule to block requests to order endpoints from non-admin users.
• Use a plugin like "User Role Editor" to restrict API access.
• Apply a virtual patch by modifying the plugin code (if possible) to add authorization checks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated GET requests to /wp-json/learnpress/v1/orders/ with sequential or random IDs.
  • Unusual user agents or IP addresses accessing order endpoints.
• File IOCs:
  • Modified LearnPress plugin files (if attacker attempts to patch).
  • Suspicious log entries in WordPress debug.log.
• Behavioral IOCs:
  • Low-privileged users accessing order data.
  • Sudden enrollment in paid courses without payment.

Detection Engineering

YARA Rule

rule Detect_LearnPress_IDOR_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-1289 in LearnPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1289"
    strings:
        $api_path = "/wp-json/learnpress/v1/orders/"
        $user_email = "user_email"
        $course_id = "course_id"
    condition:
        $api_path and ($user_email or $course_id)
}

Sigma Rule

title: LearnPress IDOR Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-1289 by accessing order endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/wp-json/learnpress/v1/orders/'
    condition: selection
falsepositives:
    - Legitimate admin access
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1289 LearnPress IDOR Attempt"; flow:to_server,established; content:"/wp-json/learnpress/v1/orders/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the LearnPress plugin until a patch is available.
2. Restrict API access to order endpoints using a WAF or server-level rules.
3. Monitor logs for suspicious activity related to order endpoints.

Long-term Fix:

• Apply a patch from the vendor when released.
• Implement custom authorization checks in the plugin code (if you have development resources).
• Consider switching to an alternative LMS plugin if LearnPress does not provide a timely fix.

Workaround:

• Use a plugin like "WP REST API Authentication" to require authentication for all API requests.
• Add a custom function to your theme's functions.php to validate order ownership:

  add_filter('learnpress/rest-api/check-order-permission', function($permission, $order_id) {
      $order = learn_press_get_order($order_id);
      if ($order && $order->get_user_id() !== get_current_user_id() && !current_user_can('manage_options')) {
          return false;
      }
      return $permission;
  }, 10, 2);
  

Valters IT