WordPress WP Courses 2.0.29 Information Disclosure / Authorization Bypass

WordPress WP Courses plugin versions 2.0.29 and below suffer from an issue that allows an unauthenticated attacker the ability to ex-filtrate all the content of courses through the WordPress REST API.

MD5 | 44b651d956b8e89fb868cb5ebd9d676c

WP Courses is a Wordpress plugin allowing to define courses with 
lessons. The course can be:

- accessible to everyone without authentication;
- only available for logged-in users;
- only available for logged-in and paying users.

In the latter case, only when a user is registered to WordPress and has
bought the product via a third plugin (for example WooCommerce) the
contents of the lessons are shown.

We have stumbled upon a severe information disclosure vulnerability on
WP Course <= 2.0.29 that gives an unauthenticated attacker the ability
to exfiltrate all the content of courses (for example videos links,
etc...) through the Wordpress REST API (/wp-json).

We have published more details and a root cause analysis in the
following link:

A CVE has been requested but not assigned yet.

Related Posts