https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 05:42:43 +0000 https://db.gcve.eu/vuln/ghsa-33v5-7wpw-28gp <p>LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user&#39;s course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load_content_via_ajax REST route, which only requires a public wp_rest nonce, to add or remove courses from any user&#39;s wishlist and determine whether a given course is wishlisted by iterating user_id and course_id values.</p> <p>LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user&#39;s course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load_content_via_ajax REST route, which only requires a public wp_rest nonce, to add or remove courses from any user&#39;s wishlist and determine whether a given course is wishlisted by iterating user_id and course_id values.</p> https://db.gcve.eu/vuln/ghsa-33v5-7wpw-28gp