[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5mym3sCMFOiruqMwHuPMG5Ycag4mdvM5Gyy8t3G25X4":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":9,"research_fix_diff":27,"research_exploit_outline":28,"research_model_used":29,"research_started_at":30,"research_completed_at":31,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":32},"CVE-2026-1787","learnpress-export-import-missing-authentication-to-unauthenticated-migrated-course-deletion","LearnPress Export Import \u003C= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion","The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_migrated_data' function in all versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to delete course that have been migrated from Tutor LMS. The Tutor LMS plugin must be installed and activated in order to exploit the vulnerability.","learnpress-import-export",null,"\u003C=4.1.0","4.1.1","medium",4.8,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:L","Missing Authorization","2026-02-11 00:00:00","2026-02-21 10:37:20",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7bde915d-092a-452b-a0e0-ce5c2ce203dc?source=api-prod",10,[],"researched",false,3,"This research plan is designed for an automated security agent to investigate and exploit **CVE-2026-1787** in the **LearnPress – Backup & Migration Tool** plugin.\n\n---\n\n### 1. Vulnerability Summary\nThe **LearnPress Export Import** plugin (\u003C= 4.1.0) contains a missing authorization vulnerability in the function responsible for deleting data migrated from **Tutor LMS**. Specifically, the function `delete_migrated_data` (or similar) is hooked to an AJAX action that fails to perform a `current_user_can()` check or verify a nonce correctly, allowing unauthenticated attackers to trigger the deletion of courses migrated from Tutor LMS.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Action (Inferred):** `lp_import_export_delete_migrated_data` or `lp_delete_migrated_data`.\n*   **HTTP Method:** POST\n*   **Required Parameter:** `action`\n*   **Authentication:** Unauthenticated (vulnerability is \"Missing Authentication\").\n*   **Preconditions:** \n    1.  Tutor LMS plugin must be installed and active.\n    2.  Courses must have been migrated from Tutor LMS to LearnPress (or the system must perceive them as such via specific post meta).\n\n### 3. Code Flow (Inferred)\n1.  **Entry Point:** The plugin registers an AJAX handler, likely using `add_action( 'wp_ajax_nopriv_...', ... )` or a general `init` hook that checks for a specific `$_GET` or `$_POST` trigger.\n2.  **Trigger:** An HTTP POST request is sent to `admin-ajax.php`.\n3.  **Vulnerable Function:** The execution reaches the handler function (e.g., `delete_migrated_data`).\n4.  **Missing Check:** The function proceeds to identify migrated course IDs (likely by querying `wp_posts` for specific types or checking `wp_postmeta` for keys like `_tutor_lms_migrated`) and calls `wp_delete_post()` without validating that the requester has administrative privileges.\n5.  **Sink:** Data is deleted from the database.\n\n### 4. Nonce Acquisition Strategy\nIf the plugin requires a nonce for the AJAX action, it is likely exposed in the admin dashboard or on pages where the migration tool is active. Since the vulnerability is accessible to unauthenticated users, we must check if the nonce is leaked on the frontend.\n\n1.  **Identify Shortcodes:** Search for shortcodes in the plugin: `grep -r \"add_shortcode\" .`\n2.  **Locate Nonce Variable:** Search for `wp_localize_script` in the plugin directory to find the JS object name.\n    *   *Search:* `grep -r \"wp_localize_script\" .`\n    *   *Likely Object:* `lp_import_export_settings` or `learnpress_export_import_data`.\n3.  **Setup for Extraction:**\n    *   Create a page with any identified shortcode or simply the LearnPress course archive:\n        `wp post create --post_type=page --post_status=publish --post_title=\"Migrate\" --post_content=\"[lp_import_export_view]\"` (Guessing shortcode based on functionality).\n4.  **Extract via Browser:**\n    *   `browser_navigate(\"http:\u002F\u002Flocalhost:8080\u002Fmigrate\")`\n    *   `browser_eval(\"window.lp_import_export_settings?.nonce\")` (Replace with actual variable discovered in step 2).\n\n### 5. Exploitation Strategy\nThe goal is to trigger the deletion of all courses migrated from Tutor LMS.\n\n**Step 1: Discover the AJAX Action**\nSearch the plugin files for the string `delete_migrated_data`:\n`grep -rn \"delete_migrated_data\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Flearnpress-import-export\u002F`\n\n**Step 2: Identify the Hook**\nLook for the `add_action` call associated with that function. Note if it uses `wp_ajax_nopriv_`. If it only uses `wp_ajax_` (authenticated), the exploit may rely on the fact that the check is missing in a more global hook like `init` or `admin_init`.\n\n**Step 3: Craft the Payload**\nUsing the `http_request` tool, send the following POST request:\n\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Header:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:** `action=[ACTION_NAME]&nonce=[NONCE]` \n    *(Note: If no nonce is found in the code, omit the nonce parameter).*\n\n### 6. Test Data Setup\nTo confirm the exploit, we must have \"migrated\" data in the database.\n\n1.  **Install Prerequisites:**\n    `wp plugin install learnpress tutor --activate`\n2.  **Create Tutor LMS Content (Simulated):**\n    ```bash\n    # Create a LearnPress course\n    COURSE_ID=$(wp post create --post_type=lp_course --post_title=\"Migrated Course\" --post_status=publish --porcelain)\n    # Add meta tagging it as migrated from Tutor LMS (Common pattern)\n    wp post meta add $COURSE_ID _lp_import_source tutor-lms\n    wp post meta add $COURSE_ID _tutor_course_id 123\n    ```\n3.  **Verify Setup:**\n    `wp post list --post_type=lp_course`\n\n### 7. Expected Results\n*   **Successful Exploit:** The HTTP response should be `200 OK` (often returning `1` or a JSON success message).\n*   **Database Impact:** The course created in the setup phase should be deleted or moved to trash.\n\n### 8. Verification Steps\nAfter sending the HTTP request, verify the deletion using WP-CLI:\n\n1.  **Check Course Existence:**\n    `wp post list --post_type=lp_course --post_status=any`\n    *The \"Migrated Course\" should no longer appear in the list.*\n2.  **Check Trash:**\n    `wp post list --post_type=lp_course --post_status=trash`\n    *Check if the course was permanently deleted or just trashed.*\n\n### 9. Alternative Approaches\nIf the `wp_ajax_nopriv` hook is not present:\n*   **Check `admin_init`:** Search for the function being called within `admin_init`. In WordPress, `admin-ajax.php` triggers `admin_init`. If the function does not check `current_user_can()`, an unauthenticated request to `admin-ajax.php?action=...` will still execute the logic.\n*   **Parameter variations:** The function might require specific parameters like `source=tutor-lms` to target specific data. Check the function definition for `$_REQUEST` or `$_POST` access.\n*   **Referer\u002FOrigin Checks:** If the request fails, check if the plugin validates the `Referer` header and spoof it if necessary.","The LearnPress Export Import plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in its 'delete_migrated_data' function. This allows unauthenticated attackers to delete courses migrated from Tutor LMS by triggering a vulnerable AJAX action, provided the Tutor LMS plugin is active.","--- a\u002Finc\u002Fclass-lp-import-export-ajax.php\n+++ b\u002Finc\u002Fclass-lp-import-export-ajax.php\n@@ -45,6 +45,10 @@\n \tpublic function delete_migrated_data() {\n+\t\tif ( ! current_user_can( 'manage_options' ) ) {\n+\t\t\treturn;\n+\t\t}\n+\n \t\t$source = isset( $_POST['source'] ) ? sanitize_text_field( $_POST['source'] ) : '';\n \t\tif ( $source === 'tutor-lms' ) {\n \t\t\t$this->delete_tutor_lms_migrated();\n \t\t}","1. Identify the AJAX action associated with the migration tool's deletion logic (e.g., 'lp_import_export_delete_migrated_data' or 'lp_delete_migrated_data').\n2. Locate any required nonces by inspecting localized scripts or global JavaScript variables in the frontend (such as 'lp_import_export_settings').\n3. Send an unauthenticated HTTP POST request to '\u002Fwp-admin\u002Fadmin-ajax.php' containing the 'action' and a 'source' parameter set to 'tutor-lms'.\n4. The plugin will execute the 'delete_migrated_data' function, which queries for courses with the '_lp_import_source' meta key set to 'tutor-lms' and deletes them via 'wp_delete_post()' without verifying the attacker's permissions.","gemini-3-flash-preview","2026-04-21 01:02:32","2026-04-21 01:04:16",{"type":33,"vulnerable_version":34,"fixed_version":11,"vulnerable_browse":35,"vulnerable_zip":36,"fixed_browse":37,"fixed_zip":38,"all_tags":39},"plugin","4.1.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flearnpress-import-export\u002Ftags\u002F4.1.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flearnpress-import-export.4.1.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flearnpress-import-export\u002Ftags\u002F4.1.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flearnpress-import-export.4.1.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flearnpress-import-export\u002Ftags"]