Nias course <= 1.3.3 - Unauthenticated Insecure Direct Object Reference to Certificate Forgery via generate_certificate AJAX Action
- ID
- WPSEC-2026-2824
- Plugin
- Nias Course Builder (nias-course)
- Affected
- from 1.2.7 before 2.0.0
- Remediation
- Update to 2.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Nias course on WPSec AttackSurface
- Fix released
- Published
Description
The Nias Course Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the generate_certificate AJAX action (handle_certificate_generation) in all versions up to, and including, 1.3.3, due to missing validation that the requested user_id belongs to the current user and that the submitted certificate code, course name and date match a certificate actually issued. The handler is registered for unauthenticated users and is protected only by a shared nonce that is printed on the certificate page for any logged-in student with an eligible course and for any visitor opening a valid certificate verification link. This makes it possible for unauthenticated attackers who obtain such a nonce to generate certificate PDFs for any user ID with an arbitrary course name, date and certificate code, forging certificates in another user's name and exposing that user's first and last name.
References
- https://wpsec.com/vuln/WPSEC-2026-2824/
- https://plugins.svn.wordpress.org/nias-course/tags/2.0.0/
- https://wordpress.org/plugins/nias-course/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS