Critical severity9.8NVD Advisory· Published Nov 9, 2024· Updated Jun 17, 2026
CVE-2024-10470
CVE-2024-10470
Description
The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated.
Affected products
4cpe:2.3:a:vibethemes:wordpress_learning_management_system:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:vibethemes:wordpress_learning_management_system:*:*:*:*:*:wordpress:*:*range: <4.963
- (no CPE)range: 0
- Range: <=4.962
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.