[CVE-2020-11511] WordPress Plugin LearnPress < – User Registration Privilege Escalation

# Exploit Title: WordPress Plugin LearnPress < – User Registration Privilege Escalation# https://www.exploit-db.com/exploits/50138# https://packetstormsecurity.com/files/163538/WordPress-LearnPress-Privilege-Escalation.html# Date: 07-17-2021# Exploit Author: nhattruong or nhattruong.blog# Vendor Homepage: https://thimpress.com/learnpress/# Software Link: https://wordpress.org/plugins/learnpress/# Version: < References link: https://wpscan.com/vulnerability/22b2cbaa-9173-458a-bc12-85e7c96961cd# CVE: CVE-2020-11511 The function learn_press_accept_become_a_teacher can be used to boot a registered user to a trainer position, resulting in a privilege escalation. The reason is that the code doesn’t check the permissions of the requesting person, consequently letting any pupil name this feature.Continue reading “[CVE-2020-11511] WordPress Plugin LearnPress < – User Registration Privilege Escalation”

[CVE-2020-6010] WordPress Plugin LearnPress < – Time-Based Blind SQL Injection (Authenticated)

DB-Exploit: https://www.exploit-db.com/exploits/50137PacketStorm: https://packetstormsecurity.com/files/163536/WordPress-LearnPress-SQL-Injection.html Exploit Title: WordPress Plugin LearnPress < – SQL Injection (Authenticated) Date: 07-17-2021 Exploit Author: nhattruong or nhattruong.blog Vendor Homepage: https://thimpress.com/learnpress/ Software Link: https://wordpress.org/plugins/learnpress/ Version: < References link: https://wpscan.com/vulnerability/10208 CVE: CVE-2020-6010 POC: Go to url http:///wp-admin Login with a cred Execute the payload Modify current_items[] as you want