Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2024-12172 EUVD-2024-50647GHSA-9q7v-rrcv-j2hh

WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update

Published Dec 12, 2024 · Updated Apr 8, 2026 · Assigned by Wordfence

Vendor: hookandhook Product: WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses Category: Web / CMS

Description

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user's metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0.

Affected products

VendorProductAffectedFixed
hookandhook WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses ≤ 3.2.21 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • RandomRobbieBF/CVE-2024-12172 ★ 0 · Dec 16, 2024

    WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References