CVE-2023-6223

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the details of another user's course progress.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	<= 4.2.5.7

References

https://plugins.trac.wordpress.org/changeset/3013957/learnpressRelease Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/215d5d9e-dabb-462d-8c51-952f8c497b78?source=cveProduct, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/3013957/learnpressRelease Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/215d5d9e-dabb-462d-8c51-952f8c497b78?source=cveProduct, Third Party Advisory

Timeline

Published: Jan 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-62255.4The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta sh CVE-2023-62264.3The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,CVE-2023-62283.3An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based b CVE-2023-62299.8Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on CVE-2023-62309.8Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser CVE-2023-62319.8Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the netwo CVE-2023-62329.8Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser CVE-2023-62339.8Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the n CVE-2023-62349.8Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attack CVE-2023-62357.8An uncontrolled search path element vulnerability has been found in the Duet Display product, affecting version 2.5.9.1. An attacker could p CVE-2023-62367.3A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second t CVE-2023-62375.9Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function E