WP Learn Manager, 56031d26-4b15-47d7-9fa3-135299d591da
- CVE, Research URL
- Home page URL
- Application
- Published on
- -
- Research Description
- WP Learn Manager [learn-manager] < 1.1.5 (closed) WP LMS < 1.1.5 - Unauthenticated Arbitrary User Field Edition/Creation The plugin is lacking any CSRF and capability checks when creating and editing User Fields, allowing unauthorised edition and creation of them either via CSRF or as any user (including unauthenticated) v1.1.5 added CSRF but still no capability check
- Affected versions
-
max 1.1.5.
- Status
-
vulnerable