CVE-2024-11868: 
WordPress vulnerability analysis and mitigation

The LearnPress – WordPress LMS Plugin for WordPress (versions up to and including 4.2.7.3) contains a Sensitive Information Exposure vulnerability identified as CVE-2024-11868. The vulnerability exists in the class-lp-rest-material-controller.php file and allows unauthenticated attackers to extract potentially sensitive paid course material (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, requires no user interaction, has unchanged scope, and can result in low confidentiality impact with no impact on integrity or availability (NVD).

The primary impact of this vulnerability is the potential exposure of sensitive paid course material to unauthorized users. Unauthenticated attackers can access and extract course content that should be restricted to paying customers (NVD).

Users are advised to update their LearnPress WordPress plugin to a version newer than 4.2.7.3 to address this vulnerability (NVD).