The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_review' function in all versions up to, and including, 7.5.1. This makes it possible for unauthenticated attackers to publish an unrestricted number of reviews on the site.
References
Configurations
History
08 Apr 2026, 19:19
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-284 |
23 Jan 2025, 19:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/changeset/3036762/lifterlms/tags/7.5.2/includes/class.llms.review.php?old=2903997&old_path=lifterlms/trunk/includes/class.llms.review.php - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f41400-5c59-444d-9c1e-121e83449521?source=cve - Third Party Advisory | |
| CWE | CWE-862 | |
| CPE | cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:wordpress:*:* | |
| First Time |
Lifterlms lifterlms
Lifterlms |
21 Nov 2024, 08:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/changeset/3036762/lifterlms/tags/7.5.2/includes/class.llms.review.php?old=2903997&old_path=lifterlms/trunk/includes/class.llms.review.php - | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f41400-5c59-444d-9c1e-121e83449521?source=cve - |
13 Mar 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-13 16:15
Updated : 2026-04-08 19:19
NVD link : CVE-2024-0377
Mitre link : CVE-2024-0377
CVE.ORG link : CVE-2024-0377
JSON object : View
Products Affected
lifterlms
- lifterlms