CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32714 – WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-32714
Missing Authorization vulnerability in Academy LMS academy.This issue affects Academy LMS: from n/a through 1.9.16. Vulnerabilidad de autorización faltante en Academy LMS Academy. Este problema afecta a Academy LMS: desde n/a hasta 1.9.16. The Academy LMS plugin for WordPress is vulnerable to unauthorized access due to insufficient validation on the enroll_course() function in versions up to, and including, 1.9.16. This makes it possible for authenticated attackers, with subscriber-level access and above, to enroll in paid courses for free. • https://patchstack.com/database/vulnerability/academy/wordpress-academy-lms-plugin-1-9-16-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25486 – Clone <= 2.3.7 - Missing Authorization via wp_ajax_tifm_save_decision
https://notcve.org/view.php?id=CVE-2023-25486
The Clone plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wp_ajax_tifm_save_decision function in versions up to, and including, 2.3.7. This makes it possible for authenticated attackers with subscriber-level access, and above, to modify the 'Test new plugins before installing' setting. • CWE-862: Missing Authorization •