Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

  1. Reconshell
  2. Vulnerabilities (CVE)
Filtered by vendor Wpcoursesplugin Subscribe
Filtered by product Wp-courses
Total 1 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-26876 1 Wpcoursesplugin 1 Wp-courses 2021-07-21 5.0 MEDIUM 7.5 HIGH
The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).