VULNERABILITY INTELLIGENCE

CVE-2024-1209

CVSS score5.3 MEDIUM

EPSS probability2.40%

CISA KEVNot currently listed

Published2024-02-05

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attackers to obtain those uploads.

Weakness classification

security@wordfence.com: CWE-200
nvd@nist.gov: NVD-CWE-noinfo

Primary references

security@wordfence.com — Exploit, Third Party Advisory
security@wordfence.com — Release Notes
security@wordfence.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory