CVE-2020-7916

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-79185.4An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder CVE-2020-79197.5Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attack CVE-2020-79207.5pmm-server in Percona Monitoring and Management (PMM) 2.2.x before 2.2.1 allows unauthenticated denial of service.CVE-2020-79215.3Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with vali CVE-2020-79226.5X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster impro CVE-2020-79236.5A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant i CVE-2020-79246.5Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB CVE-2020-79257.5Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to u CVE-2020-79266.5A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant i CVE-2020-79276.5Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role pri CVE-2020-79286.5A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. T CVE-2020-79296.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This