CVE-2024-10010 in LearnPress Plugin
Summary
by MITRE • 12/12/2024
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/07/2025
The vulnerability identified as CVE-2024-10010 affects the LearnPress WordPress plugin version 4.2.7.2 and earlier, presenting a critical security risk through stored cross-site scripting flaws in its administrative settings. This vulnerability specifically targets high-privilege users such as administrators who possess the capability to modify plugin configurations, creating a significant attack surface within WordPress environments where unfiltered_html permissions are restricted. The flaw exists in the plugin's handling of user input within its settings interface, where insufficient sanitization and escaping mechanisms allow malicious scripts to be persistently stored and executed when the affected settings are rendered in the admin dashboard.
The technical implementation of this vulnerability stems from inadequate input validation and output escaping within the LearnPress plugin's administrative components. When administrators modify plugin settings, the data is not properly sanitized before being stored in the WordPress database, nor is it adequately escaped when subsequently displayed in the admin interface. This creates a persistent XSS vector where malicious scripts can be injected into plugin configuration fields and executed whenever the settings page is accessed by authenticated users. The vulnerability is particularly concerning in multisite WordPress installations where the unfiltered_html capability is typically restricted to prevent arbitrary HTML injection across networked sites, yet the flaw allows bypassing these security restrictions.
The operational impact of this vulnerability extends beyond simple script execution, as it enables attackers with administrator privileges to potentially escalate their access within the WordPress environment. Successful exploitation could allow attackers to steal session cookies, modify plugin configurations, access sensitive data, or even establish persistent backdoors within the WordPress installation. The stored nature of the vulnerability means that once a malicious script is injected into the plugin settings, it will execute every time an administrator accesses the affected pages, potentially affecting multiple users within the same WordPress network. This makes the vulnerability particularly dangerous in multi-user environments where multiple administrators may access the same plugin settings.
Organizations affected by this vulnerability should immediately update to LearnPress plugin version 4.2.7.2 or later, which implements proper sanitization and escaping mechanisms for all user-controllable settings. Security teams should conduct comprehensive audits of all plugin configurations to identify any previously injected malicious scripts and monitor for suspicious administrative activities. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and maps to ATT&CK technique T1059.007 for script execution within web applications. Additionally, this vulnerability demonstrates the importance of proper input validation and output escaping practices as outlined in OWASP Top Ten category A03:2021 - Injection, which emphasizes the need for robust sanitization of user inputs to prevent malicious code execution in web applications.