EUVD-2026-71990
GHSA-4r4h-wxqr-24rc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Description states unauthenticated exploitation is possible, so PR:N; C:L for unauthorized content access, I:L for enrollment record manipulation, A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.
AnalysisAI
Authorization bypass in the LearnDash LMS WordPress plugin (versions 4.25.0-5.1.6) allows attackers to enroll arbitrary users in paid courses without completing payment, systematically circumventing the plugin's entire payment verification workflow. The root cause is CWE-862 (Missing Authorization): enrollment action handlers fail to verify that the requesting party has the appropriate permission or has satisfied payment conditions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target site must be running LearnDash LMS for WordPress in versions 4.25.0 through 5.1.6 and must have at least one paid course configured for enrollment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The Wordfence-assigned CVSS 3.1 score of 5.4 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) conflicts materially with the advisory description, which states exploitation is possible by 'unauthenticated attackers' - a PR:N scenario that would raise the base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade LearnDash LMS to version 5.1.6.1 or later, confirmed as the patched release via the Nexcess changelog at https://docs.nexcess.com/software/changelogs/learndash/sfwd-lms/5-1-6-1/; this update can be applied through the standard WordPress plugin update mechanism. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Learndash Lms
View allUnrestricted file upload in the LearnDash LMS WordPress plugin (versions ≤5.1.5) allows authenticated subscribers enroll
The LearnDash LMS plugin for WordPress contains a blind time-based SQL injection vulnerability in the 'filters[orderby_o
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today