LifterLMS <= 7.5.1 is vulnerable to Missing Authorization via process_review vulnerability

Unauthenticated

Published
2024-02-27

The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_review' function in all versions up to, and including, 7.5.1. This makes it possible for unauthenticated attackers to publish an unrestricted number of reviews on the site.

CVE

https://www.cve.org/CVERecord?id=CVE-2024-0377

CVSS

Score:5.3

Severity:Medium

Version: 7.5.1

There is a patch available in v7.5.2 and we strongly recommend you update to this version as soon as possible.