Auth bypass in Learndash
CVE-2023-3105
The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for attackers with with existing account access at any level, to change user passwords and potentially take over administrator accounts.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.022 (81.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Learndash
- Stellarwp Learndash Lms — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@wordfence.com (Third Party Advisory)
- security@wordfence.com (Release Notes)
Frequently asked questions
- What is CVE-2023-3105?
- CVE-2023-3105 is a high-severity vulnerability in Learndash, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.8/10. Published 2023-07-12.
- How severe is CVE-2023-3105?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2023-3105 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.