CVE-2020-26876

The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the…

published October 7, 2020

CVSS
—
EPSS
11%
Percentile
95.8
In the wild
Unconfirmed
What it is

The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.10551 · 95.8th percentile
Published
2020-10-07T16:56Z
EPSS history
Timeline
  • 07 OCT 16:56Z
    The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the…
    cvelistv5