Cyber Resilience

CVE-2024-12172

High

Published: 12 December 2024

Published
12 December 2024
Modified
15 April 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.1124 93.7th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-12172 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 6.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The WP Courses LMS plugin for WordPress, in all versions through 3.2.21, contains a missing capability check in the wpc_update_user_meta_option() function. This flaw is tracked as CVE-2024-12172 and carries a CVSS 3.1 base score of 7.5. The issue permits any authenticated user to modify arbitrary user metadata entries stored by WordPress.

An attacker with Subscriber-level access or higher can invoke the unprotected function to overwrite metadata such as wp_capabilities for any user account. Setting this value to 0 removes all roles from the target, which can be used to lock administrators out of the site while leaving the attacker’s own account intact.

The referenced Wordfence advisory and the linked plugin changeset indicate that the vendor addressed the missing authorization check in a subsequent release. Site owners are advised to update the plugin to the newest available version and to review user capabilities for unexpected changes.

EPSS for the CVE has remained in the 0.11–0.13 range with only modest movement between current and peak values.

EU & UK References

Vulnerability details

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21.…

more

This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user's metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Wordpress
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-862

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

addresses: CWE-862

Reviews of access controls detect missing authorization checks on critical functions or resources.

addresses: CWE-862

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

addresses: CWE-862

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

addresses: CWE-862

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

addresses: CWE-862

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

addresses: CWE-862

The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.

addresses: CWE-862

Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.

References