2 lines
2.9 KiB
JSON
2 lines
2.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes","vendor":"chrisbadgett","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"A7592D4A-F1A1-4102-8807-08FC59F1A16B","versionEndExcluding":"8.0.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to \"Trash\" for every published post, therefore limiting the availability of the website's content."},{"lang":"es","value":"El complemento LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes para WordPress es vulnerable al borrado de entradas no autenticadas debido a la falta de comprobación de capacidad en la función delete_access_plan y las llamadas AJAX relacionadas en todas las versiones hasta la 8.0.1 incluida. Esto permite que atacantes no autenticados cambien el estado a \"Papelera\" para cada entrada publicada, limitando así la disponibilidad del contenido del sitio web."}],"id":"CVE-2025-2290","lastModified":"2026-06-17T09:06:41.903","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-2290","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-03-19T14:03:24.818201Z","version":"2.0.3"}}]},"published":"2025-03-19T05:15:41.180","references":[{"source":"security@wordfence.com","tags":["Patch"],"url":"https://plugins.trac.wordpress.org/changeset/3257328/lifterlms/trunk/includes/class.llms.ajax.handler.php"},{"source":"security@wordfence.com","tags":["Third Party Advisory"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f64dbf2-b75a-4a35-9b4e-413b8fd1fff0?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@wordfence.com","type":"Secondary"}]}
|