« Volver al listado

CVE-2020-6009

Estado: ModificadaCrítica (9.8)—

LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Learndash — Learndash

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6009",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@checkpoint.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "LearnDash Wordpress Plugin",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.1.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-01T22:15:18.440",
  "references": [
    {
      "url": "https://learndash.releasenotes.io/release/YBfaq-version-316",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://learndash.releasenotes.io/release/YBfaq-version-316",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@checkpoint.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection."
    },
    {
      "lang": "es",
      "value": "El plugin LearnDash de Wordpress versiones por debajo de 3.1.6, es vulnerable a una Inyección SQL No Autenticada."
    }
  ],
  "lastModified": "2026-06-17T03:22:35.160",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:learndash:learndash:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DBB70DF1-82FA-465E-B258-5A3715200212",
              "versionEndExcluding": "3.1.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@checkpoint.com"
}