EUVD-2026-65272
GHSA-2qx9-4rjh-4r9j
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Editor access is PR:L not PR:H; single AJAX POST needs no special conditions so AC:L; plugin corruption enables availability impact so A:L.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.
AnalysisAI
Unauthorized option-write in LearnPress (WordPress LMS plugin) versions up to and including 4.4.4 allows authenticated attackers with Editor-level access to overwrite arbitrary WordPress site options with a page ID integer via the learnpress_create_page AJAX endpoint. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce - both granted to Editors - but applies no allowlist to the field_name parameter before it is forwarded to update_option(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with the WordPress Editor role or higher (the edit_pages capability and a valid wp_rest nonce are both prerequisites). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) understates the realistic risk in two ways: AC:H appears to overstate complexity (the attack is a single crafted AJAX POST with no race condition or special circumstance), and A:N ignores that corrupting active_plugins can take the site fully offline. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained Editor-level credentials - via credential stuffing, phishing, or a compromised contributor account - sends a crafted authenticated POST to wp-admin/admin-ajax.php with action=learnpress_create_page and field_name=users_can_register, along with a valid wp_rest nonce. The handler creates a new WordPress page (yielding a page ID of 1 or greater) and writes that truthy integer to the users_can_register option, silently opening public registration on the site. … |
| Remediation | Upstream fix available (Trac changeset 3659902); a released patched plugin version is not independently confirmed from the provided data - verify the current version in the WordPress plugin repository before updating. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Sensitive information exposure in the LearnPress LMS plugin for WordPress (versions up to and including 4.4.1) lets unau
Course enrollment data exposure in LearnPress WordPress LMS plugin (all versions through 4.3.9.1) enables authenticated
Stored Cross-Site Scripting in the LearnPress WordPress LMS plugin (versions up to and including 4.4.0) allows authentic
Stored Cross-Site Scripting in LearnPress WordPress LMS Plugin up to version 4.3.3 allows authenticated contributors to
Sensitive information exposure in LearnPress WordPress LMS Plugin (all versions through 4.3.6) allows unauthenticated re
Payment bypass in LearnPress WordPress LMS Plugin (all versions ≤ 4.3.5) allows authenticated subscribers to enroll in a
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today