The WPLMS plugin for WordPress contains a critical authorization flaw that allows unauthenticated remote attackers to access restricted system functionality, potentially leading to unauthorized data disclosure.

The vulnerability is classified as a Missing Authorization flaw (CWE-862). It stems from a failure to enforce access control checks within the wplms_plugin, enabling unauthenticated users to trigger sensitive functions that should be restricted.

The ability for an unauthenticated attacker to bypass access controls presents a significant risk to the confidentiality of sensitive student and course data managed within the WPLMS platform. With a CVSS score of 7.3, this high-severity vulnerability could lead to unauthorized data exposure, facilitating further reconnaissance or targeted attacks against the hosting environment.

Immediate Action: Since a specific patch version is not currently identified, administrators should monitor the VibeThemes website for security updates and apply them immediately upon release.

Proactive Monitoring: Review web server and WordPress access logs for anomalous requests to the wplms_plugin endpoints, specifically looking for unauthorized attempts to access administrative or restricted functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious traffic patterns targeting WordPress plugin endpoints and restrict direct access to the vulnerable plugin files.

Public Exploit Available: Unknown.

Given the high impact of this authorization bypass, organizations should treat this as a priority. If a vendor update is not immediately available, consider disabling the affected WPLMS plugin functionality or restricting access to the associated site modules until a secure version is released and verified.