CVE-2024-10470: WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion
First published: Sat Nov 09 2024(Updated: )
The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WPLMS | <=4.962 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-10470?
CVE-2024-10470 is classified as a high severity vulnerability due to potential arbitrary file read and deletion.
How do I fix CVE-2024-10470?
To fix CVE-2024-10470, update the WPLMS Learning Management System to version 4.963 or later.
What are the potential impacts of CVE-2024-10470?
The potential impacts of CVE-2024-10470 include unauthorized access to sensitive files and the ability to delete important files on the server.
Which versions of the WPLMS Learning Management System are affected by CVE-2024-10470?
CVE-2024-10470 affects all versions of the WPLMS Learning Management System up to and including version 4.962.
Is user input a factor in CVE-2024-10470?
Yes, insufficient file path validation and permission checks related to user input are contributing factors to CVE-2024-10470.
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wplms
- canonical/wplms