WPLMS Learning Management System for WordPress <= 4.962 - Unauthentifizierter beliebiger Dateilesen und -löschen

The primary impact of CVE-2024-10470 is the ability for an attacker to read and delete arbitrary files on a WordPress server. This is particularly concerning because deleting critical files like wp-config.php can lead to remote code execution. Successful exploitation allows an attacker to gain control of the web server, potentially leading to data breaches, website defacement, and further compromise of the underlying system. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors. The fact that the theme remains vulnerable even when inactive amplifies the risk, as it can be exploited regardless of the active theme.

WordPress websites utilizing the WPLMS Learning Management System plugin, particularly those running versions prior to a patch release, are at significant risk. Shared hosting environments where file permissions are not tightly controlled are especially vulnerable. Websites with legacy WordPress configurations or those lacking robust security monitoring practices are also at increased risk.

• wordpress / composer / npm:

grep -r "readfile(" /var/www/html/wp-content/plugins/wplms/

• wordpress / composer / npm:

grep -r "unlink(" /var/www/html/wp-content/plugins/wplms/

• wordpress / composer / npm:

wp plugin list | grep wplms

• wordpress / composer / npm:

curl -I http://your-wordpress-site.com/wp-content/plugins/wplms/some-sensitive-file.php

1. 2024-11-09Disclosure

   disclosure

1. Reserviert2024-10-28
2. Veröffentlicht2024-11-09
3. Geändert2024-11-12
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-10470 is to upgrade WPLMS to a version that addresses the vulnerability. Unfortunately, a specific fixed version is not provided in the input. As a temporary workaround, restrict file permissions on the WPLMS directory to prevent unauthorized access and deletion. Implement a Web Application Firewall (WAF) with rules to block attempts to access or manipulate files outside of designated directories. Regularly monitor server logs for suspicious file access or deletion attempts. After upgrading, confirm the fix by attempting to access sensitive files via the vulnerable endpoint and verifying that access is denied.