CVE-2020-26876: 
WordPress vulnerability analysis and mitigation

The wp-courses plugin through version 2.0.27 for WordPress contains a vulnerability (CVE-2020-26876) that allows remote attackers to bypass payment requirements for accessing course videos and materials. The vulnerability was discovered in September 2020 and exploited in the wild. The issue stems from the REST API being enabled for custom post types, specifically through the /wp-json endpoint (NVD, WPScan).

The vulnerability exists because the show_in_rest parameter was enabled for custom post types, allowing unauthorized access to course content through REST API endpoints such as /wp-json/wp/v2/course and /wp-json/wp/v2/lesson. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue is classified as CWE-306 (Missing Authentication for Critical Function) (NVD).

The vulnerability allows unauthorized users to access premium course content, including videos and materials, without making the required payments. This directly impacts the revenue model of educational websites using the plugin, as it enables free access to content intended to be monetized (WPScan).

The vulnerability has been confirmed to be exploited in the wild during September 2020. The exploitation is straightforward as it only requires accessing the REST API endpoints, making it highly exploitable with no special privileges or user interaction required (NVD).

The vulnerability was fixed in version 2.0.29 of the wp-courses plugin. The fix includes adding an option to enable or disable the REST API for courses, modules, lessons, and teachers, with the REST API being disabled by default. Users are strongly advised to update to the latest version of the plugin (WordPress Plugin Repository).