John Umoru

The plugin fails to properly verify enrollment when restricting access to protected course content. This allows authenticated users with subscriber-level access or higher, who are enrolled in at least one course, to view paid lesson, quiz, and assignment content from other courses.

An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions.

The plugin fails to enforce payment completion before activating paid membership subscriptions. This allows unauthenticated users who self-register through the open registration flow to obtain an active subscription to any paid plan without payment, granting them unauthorized access to gated content.

The plugin fails to enforce the second-factor challenge in two of its two-factor authentication REST endpoints. This allows an attacker who possesses a user's password to obtain a WordPress authentication session without completing the email OTP (One-Time Password) challenge.

The plugin fails to properly escape a user-supplied parameter before reflecting it into an HTML attribute within a non-nonce-protected AJAX response. This allows unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS), which occurs when an application includes untrusted data in a web page without proper validation, allowing the execution of malicious scripts in the victim's browser. This can be executed against any authenticated user, including administrators, via a crafted URL.

The plugin fails to properly sanitize user input before incorporating it into a SQL query. The resulting output is then passed to the `eval()` function, which enables unauthenticated users to execute arbitrary PHP code on the server. This process involves a SQL injection (SQLi) leading to Remote Code Execution (RCE), where an attacker can run commands on the host operating system from a remote machine.