LearnDash LMS EUVD-2026-71990

The target site must be running LearnDash LMS for WordPress in versions 4.25.0 through 5.1.6 and must have at least one paid course configured for enrollment. A direct conflict exists between the Wordfence description ('unauthenticated attackers') and the CVSS vector (PR:L, low-privileged), meaning whether a WordPress subscriber account is required is unconfirmed - security teams should verify this before determining access controls. No non-default configuration is required: any default deployment of the affected plugin offering paid courses is potentially vulnerable. Exploitation is bounded to enrollment manipulation (granting unauthorized access to course content); there is no reported pathway to remote code execution or broader system compromise. Exploitation is limited by the need to specify valid user and course identifiers, which may require minor reconnaissance against the target site.

The Wordfence-assigned CVSS 3.1 score of 5.4 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) conflicts materially with the advisory description, which states exploitation is possible by 'unauthenticated attackers' - a PR:N scenario that would raise the base score. Security teams should not rely on either the Medium severity or the PR:L classification without independently verifying whether a WordPress account is required to invoke the vulnerable endpoint. No EPSS score, KEV listing, or public exploit code is provided or referenced, meaning active exploitation is not confirmed. The numeric CVSS score understates business impact: unauthorized enrollment in paid courses is a direct revenue-integrity and intellectual-property loss, affecting any site monetizing educational content on the affected plugin versions. The low attack complexity (AC:L) and network vector (AV:N) make this trivially exploitable at scale once the specific endpoint parameters are known.

An attacker - potentially without any WordPress account, or with only a subscriber-level account depending on the actual authentication requirement - sends a crafted POST request to the LearnDash enrollment endpoint specifying a target user ID and a paid course ID, omitting or forging payment confirmation parameters. The plugin's missing authorization check records the enrollment as legitimate, and the target user (or the attacker's own account) gains immediate access to premium course content without payment. No public exploit code has been identified at time of analysis, but the straightforward nature of a missing authorization check makes this accessible to an attacker with basic knowledge of WordPress AJAX/REST conventions.