Unauthenticated Information Disclosure in LearnDash LMS

LearnDash LMS, a widely used WordPress learning management system, contains critical vulnerabilities (CVE-2024-1208 and CVE-2024-1210) within its REST API implementation. These vulnerabilities permit unauthenticated remote attackers to access sensitive quiz content and examination questions via the /ldlms/v1/ and /ldlms/v2/ REST API endpoints. Because the plugin fails to enforce proper authorization checks on these API routes, any visitor can retrieve private assessment data without being enrolled in the associated courses or possessing administrative privileges. This vulnerability exposes proprietary course content and compromises the integrity of assessments that rely on these questions to verify student knowledge. The vulnerability was disclosed and fixed in version 4.10.3 of the LearnDash plugin. Organizations utilizing LearnDash are at risk of data exfiltration and intellectual property theft if they have not patched to the current secure version.

Impact

Successful exploitation results in the unauthorized disclosure of proprietary educational content, including complete sets of quiz and exam questions. This facilitates cheating and undermines the educational integrity of the platform. There are no reports of widespread active exploitation, but the public availability of proof-of-concept exploits significantly increases the likelihood of opportunistic discovery by malicious actors targeting WordPress-based environments.

Recommendation

Prioritized actions for security and IT teams:

• Update the LearnDash LMS plugin to version 4.10.3 or later immediately to resolve CVE-2024-1208 and CVE-2024-1210.
• Audit WordPress access logs for anomalous requests to the /wp-json/ldlms/v1/ or /wp-json/ldlms/v2/ endpoints, specifically monitoring for high-frequency requests from non-authenticated source IPs.
• Evaluate the necessity of exposing the LearnDash REST API and, if not required for business functionality, utilize the learndash_rest_api_enabled filter in class-ld-rest-api.php to disable the API for sensitive post types.