Khoa Dang

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.9 **Description** An Insecure Direct Object Reference exists via the `CourseMaterialTemplate::render material items()` callback exposed on the public `lp-ajax-handle` (load content via ajax) endpoint. The endpoint is included in the AbstractAjax no-nonce allowlist and lacks capability checks. The handler validates authorization using an attacker-supplied `course id` but fetches material rows using a separate attacker-supplied `item id` without verifying if the lesson belongs to the authorized course. This allows unauthenticated attackers to read and download course-material files from paid or enrollment-required courses, provided at least one course on the site has 'No Required Enroll' enabled and contains a material file. **Recommendations** Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.9 or later.

**Name of the Vulnerable Software and Affected Versions** Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.2.1 **Description** The plugin is susceptible to Blind Server-Side Request Forgery (SSRF), a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Unauthenticated attackers can exploit this via the `kirki data` parameter to send web requests to arbitrary locations from the web application, potentially querying or modifying information from internal services. **Recommendations** Update the plugin to a version newer than 6.2.0. As a temporary mitigation, restrict or sanitize the use of the `kirki data` parameter.