Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wp-plugins/learnpress

              master @ c96852b
            

Fixes

CVEs

CRITICAL

Peak severity

100.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

inc/admin/class.lpr-admin-ajax.php: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Unauthenticated attackers can execute arbitrary SQL queries via unsanitized SQL parameters, leading to complete database compromise. This vector is active in the wild (KEV).

Auth Bypass: Insecure direct object reference (IDOR) vulnerabilities exist when fetching sensitive user data without validating that the requesting user's identity matches the resource owner.

CSRF: Crucial admin operations, such as installing sample data or filtering users, lack robust WordPress nonce validations, allowing attackers to perform high-privilege actions via forged requests.