Description
WordPress Plugin LearnPress-WordPress LMS is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently rename an arbitrary image file. WordPress Plugin LearnPress-WordPress LMS version 4.1.4.1 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 4.1.5 or latest
References
https://bozogullarindan.com/en/2022/01/wordpress-learnpress-plugin-4.1.4.1-arbitrary-image-renaming/
Related Vulnerabilities
Coppermine Cross-site Scripting (XSS) Vulnerability (CVE-2015-3921)
Drupal Core 8.x.x Information Disclosure (8.0.0 - 8.7.14)
WordPress Plugin Poll Maker SQL Injection (3.4.1)
MySQL CVE-2014-2419 Vulnerability (CVE-2014-2419)
TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2005-4875)