Critical severity · published Nov 9, 2024
CVE-2024-10470
WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion
9.8
CVSS
34.8%
EPSS
No
On KEV
Description
The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)34.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WL
WPLMS Learning Management System for WordPress, WordPress LMS · VibeThemes
through 4.962 · source: vendor
WL
Wordpress Learning Management System · Vibethemes
before 4.963 · source: NVD, CISA
Affected product
WL
WPLMS Learning Management System for WordPress, WordPress LMS
VibeThemes
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10470
Product
https://themeforest.net/item/wplms-learning-management-system/6780226
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/1932c9b4-2fea-40f8-9748-09ded8143c11?source=cve
More from WPLMS Learning Management System for WordPress, WordPress LMS
8.8
CVE-2015-10139
WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation