LearnPress CVE-2026-7648

Exploitation requires a valid WordPress account with at minimum subscriber-level access (PR:L per CVSS vector) - anonymous unauthenticated users cannot exploit this vulnerability. The attack targets the LearnPress REST API cart endpoint (inc/rest-api/v1/frontend/class-lp-rest-courses-controller.php:L474), which must be active and reachable; standard WordPress REST API availability is the only deployment prerequisite. The specific triggering condition is supplying a user-controlled 'quantity' key with a value of zero in the REST request body, which exploits array_merge() key-precedence behavior to overwrite hardcoded defaults in add_to_cart(). Limiting factors: any WordPress site that disables user registration eliminates the subscriber account prerequisite; WAF rules that block non-standard quantity values (zero or negative) on REST cart endpoints also mitigate the attack; and SSVC Automatable: no indicates that per-course enumeration is required, reducing bulk or fully automated exploitation.

The CVSS base score of 4.3 (Medium) reflects network reachability with low complexity and low privileges, but no confidentiality or availability impact - consistent with a financial integrity bypass rather than a system compromise. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is network-exploitable by any authenticated user with subscriber-level access, requiring no user interaction and no elevated permissions beyond a basic WordPress account. Against the CVSS signal, EPSS at 0.01% (2nd percentile) and SSVC Exploitation: none indicate no observed exploitation activity at time of analysis, and SSVC Automatable: no suggests the attack requires some per-target enumeration of paid course IDs - reducing mass-exploitation risk. SSVC Technical Impact: partial aligns with the limited I:L scope. The net picture is a high-priority business risk for WordPress LMS operators monetizing courses, but a low priority in terms of infrastructure or data breach risk. The low EPSS and absent KEV listing mean immediate emergency response is not warranted for most organizations, though the ease of exploitation (AC:L, PR:L) means any authenticated user on the affected site can trivially abuse this.

An attacker registers a free subscriber account on a LearnPress-powered e-commerce site, identifies a paid course ID through normal browsing, and submits a crafted REST API POST request to the add-to-cart endpoint with the quantity parameter set to zero. The array_merge() call in add_to_cart() overwrites the default quantity, the order total resolves to $0, and the payment gateway processes it as a free transaction - granting the attacker full enrollment in the paid course without any financial charge. No public exploit code is known at time of analysis, but the attack is straightforward to reconstruct from the patch diff alone.