CVE-2024-6088

Executive Summary

CVE-2024-6088 is a critical authorization bypass vulnerability in the LearnPress – WordPress LMS Plugin for WordPress. The flaw resides in the register function, which lacks a proper capability check. This allows any unauthenticated attacker to register new user accounts on a WordPress site, even when the site administrator has disabled user registration. The default role assigned to these accounts is typically "Subscriber," but this can still lead to privilege escalation, content access, or further exploitation.

This vulnerability affects all versions up to and including 4.2.6.8.1. As of this report, no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the attack vector is trivial and the impact is significant for sites relying on registration controls.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The LearnPress plugin is distributed via the official WordPress plugin repository and is also available for manual installation. Since no patch is available, site administrators must consider removing or disabling the plugin until a fix is released. The lack of a capability check in the register function represents a classic missing authorization flaw (CWE-862).

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (attacker can enumerate users)
• Integrity Impact: Low (attacker can create accounts)
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit and can bypass a critical security control (disabled registration). However, the immediate impact is limited to account creation with low privileges.

Deep Dive & Mechanics

The LearnPress plugin provides a REST API endpoint for user registration. The vulnerable register function in the plugin's code does not verify whether the current user has the edit_users capability or whether the site's general registration setting is enabled. This means an unauthenticated attacker can send a crafted HTTP POST request to the registration endpoint and create a new user account.

The default role for new users in WordPress is typically "Subscriber," which has minimal permissions (e.g., read posts, manage own profile). However, this can be escalated if the attacker can exploit other vulnerabilities or if the site has misconfigured roles.

Attack Flow:

1. Attacker identifies a WordPress site running LearnPress <= 4.2.6.8.1.
2. Attacker sends a POST request to the LearnPress registration endpoint with parameters like username, email, and password.
3. The plugin processes the request without checking if registration is allowed or if the user has permission.
4. A new user account is created with the default role.
5. Attacker can now log in and potentially perform further attacks (e.g., privilege escalation, content access).

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.2.6.8.1): The register function in the LearnPress plugin likely looks like this (simplified):

public function register($request) {
    $username = $request->get_param('username');
    $email = $request->get_param('email');
    $password = $request->get_param('password');
    // Missing capability check
    $user_id = wp_create_user($username, $password, $email);
    if (is_wp_error($user_id)) {
        return new WP_Error('registration_failed', $user_id->get_error_message());
    }
    return rest_ensure_response(['user_id' => $user_id]);
}

Patched Code (Hypothetical): A proper fix would include a capability check:

public function register($request) {
    // Check if user registration is enabled
    if (get_option('users_can_register') != 1) {
        return new WP_Error('registration_disabled', 'User registration is currently disabled.');
    }
    // Additional capability check for admin-initiated registration
    if (!current_user_can('edit_users')) {
        return new WP_Error('rest_cannot_create_user', 'Sorry, you are not allowed to create users.', array('status' => 403));
    }
    // ... rest of the function
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with LearnPress plugin <= 4.2.6.8.1
• Network access to the site

Exploit Steps:

1. Identify the LearnPress registration endpoint (typically /wp-json/learnpress/v1/register or similar).
2. Send a POST request with the following parameters:
   • username: attacker_username
   • email: attacker@example.com
   • password: StrongPassword123!
3. Verify account creation by logging in or checking the response.

Example cURL command:

curl -X POST https://target-site.com/wp-json/learnpress/v1/register \
  -H "Content-Type: application/json" \
  -d '{"username": "attacker", "email": "attacker@example.com", "password": "P@ssw0rd!"}'

Expected Response:

{"user_id": 123}

Blue Team

Detection:

• Monitor for POST requests to /wp-json/learnpress/v1/register from unauthenticated sources.
• Alert on successful registration attempts when users_can_register is disabled.
• Review user creation logs for unexpected accounts.

Hunting:

• Search for users created outside normal registration flows.
• Check for accounts with default role "Subscriber" created after the plugin was installed.

Mitigation:

• Disable or remove the LearnPress plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block POST requests to the vulnerable endpoint.
• Use a security plugin to monitor and restrict user registration.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-json/learnpress/v1/register from unknown IPs.
  • Repeated registration attempts with different usernames/emails.
• System:
  • Unexpected user accounts in WordPress admin (Users > All Users).
  • User creation timestamps outside normal business hours.
• Logs:
  • WordPress debug log entries showing wp_create_user calls without prior authentication.
  • Web server access logs with 200 responses to the registration endpoint.

Detection Engineering

YARA Rule

rule CVE_2024_6088_LearnPress_Registration_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6088 in LearnPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6088"
    strings:
        $endpoint = "/wp-json/learnpress/v1/register"
        $username = "username"
        $email = "email"
        $password = "password"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-6088 LearnPress Unauthorized User Registration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the LearnPress registration endpoint from unauthenticated users.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/wp-json/learnpress/v1/register"
    condition: selection
falsepositives:
    - Legitimate registration attempts if registration is enabled
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6088 LearnPress Unauthorized User Registration Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-json/learnpress/v1/register"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the LearnPress plugin until a patched version is released.
2. Remove the plugin if not essential for business operations.
3. Audit existing user accounts for any unauthorized creations.
4. Implement a WAF rule to block POST requests to /wp-json/learnpress/v1/register.

Long-term Fix:

• Monitor the LearnPress plugin repository for an official patch.
• Apply the patch as soon as it becomes available.
• Consider using a security plugin that adds capability checks to REST API endpoints.

Workaround:

• If the plugin must remain active, use a custom code snippet to add a capability check to the register function via a WordPress filter or action.

Report generated by Valters IT DevSecOps & CTI Division