What is the CVSS score of EUVD-2026-40906?

EUVD-2026-40906 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

LearnPress EUVD-2026-40906

| CVE-2026-11988 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-01 Wordfence

GHSA-2qhv-qfjf-5jf4

WordPress Authentication Bypass Learnpress Wordpress Lms Plugin For Create And Sell Online Courses Wordpress Plugin Thimpress

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

REST API is network-accessible with low complexity; subscriber account required (PR:L); confidentiality-only impact on enrollment metadata with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:34 vuln.today

CVE Published

Jul 01, 2026 - 04:32 nvd

MEDIUM 6.5

DescriptionCVE.org

The LearnPress - WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.9.1 via the 'userId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the course enrollment progress and completion data belonging to any instructor or administrator account on the site. This IDOR does not apply when the target user is a regular subscriber, as the guard correctly blocks cross-subscriber access; exploitation is limited to cases where the victim user holds the LP_TEACHER_ROLE or administrator role.

AnalysisAI

Course enrollment data exposure in LearnPress WordPress LMS plugin (all versions through 4.3.9.1) enables authenticated subscribers to read the course progress and completion records of any instructor or administrator by supplying an arbitrary value to the userId REST API parameter. The lazy load controller accepts the caller-supplied key without verifying ownership, bypassing authorization for LP_TEACHER_ROLE and administrator accounts while a partial guard correctly blocks subscriber-to-subscriber cross-access. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires only a subscriber-level account, making the real-world barrier low on sites with open user registration.

Technical ContextAI

The vulnerability resides in the LearnPress plugin's REST API v1 frontend controller (inc/rest-api/v1/frontend/class-lp-rest-lazy-load-controller.php, lines 118 and 137) and the abstract LP user class (inc/user/abstract-lp-user.php, line 680), confirmed across both the 4.3.9.1 and 4.2.7.5 tagged releases in the WordPress plugin SVN repository. CWE-639 (Authorization Through User-Controlled Key) describes the root cause precisely: the userId parameter is client-supplied and used to load enrollment records without verifying that the requesting principal owns or has delegated access to the target account. WordPress user IDs are sequential integers, making enumeration of valid instructor and administrator IDs trivial via standard WordPress REST API user endpoints. The partial mitigation that blocks subscriber-to-subscriber enumeration is implemented correctly but excludes elevated-role targets, creating an asymmetric authorization gap for exactly the accounts most likely to hold sensitive instructional data.

RemediationAI

Upgrade LearnPress to version 4.4.0 or later: a WordPress SVN changeset from 4.3.9.1 to 4.4.0 (https://plugins.trac.wordpress.org/changeset?old_path=%2Flearnpress/tags/4.3.9.1&new_path=%2Flearnpress/tags/4.4.0) indicates that 4.4.0 contains the authorization fix; however, the release of this version as a distributed WordPress.org update has not been independently confirmed at time of analysis - verify availability via the WordPress plugin dashboard before applying. If an immediate upgrade is not possible, disabling open subscriber self-registration (WordPress Admin → Settings → General → uncheck 'Anyone can register') raises the exploitation barrier by requiring an attacker to already possess a site account, though this also impacts legitimate student onboarding. Restricting the /wp-json/lp/v1/ REST API namespace at the web server or WAF layer is insufficient on its own because the attack originates from authenticated subscriber sessions; any such rule must also intercept subscriber-authenticated requests to the affected lazy load endpoints, which risks breaking core LearnPress functionality such as course progress displays. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6b5e8cfd-989e-4a64-abb0-9daa22df46a4 for confirmed patch version details.