LearnPress EUVD-2026-90544

Exploitation requires that at least one course on the target site has 'No Required Enroll' enabled and owns at least one material file - this 'No Required Enroll' course provides the valid course_id used to pass the authorization check, while the attacker independently supplies the item_id of a lesson in a restricted/paid course. The vulnerable path is the CourseMaterialTemplate::render_material_items() callback reached via the public lp-ajax-handle load_content_via_ajax action, which is explicitly in LearnPress's AbstractAjax no-nonce allowlist and performs no capability check. Limiting factors: impact is read-only confidentiality (material file paths and external URLs for lessons in paid/enrollment-required courses); if no course has 'No Required Enroll' enabled with an associated material file, the authorization-side identifier cannot be satisfied and the attack does not work. No authentication or user interaction is required.

This is a genuine, easily-triggered confidentiality risk despite the absence of exploitation telemetry. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) is internally consistent with the description: a network-reachable, unauthenticated, no-user-interaction IDOR on a public AJAX endpoint that the plugin itself places in the no-nonce allowlist. No EPSS score, CISA KEV entry, or public POC was provided, so there is no evidence of active or automated exploitation (no public exploit identified at time of analysis). However, the low barrier to entry (PR:N/AC:L/UI:N) plus the large install base of LearnPress means this is a realistic priority for sites that sell or gate course content, not a high-CVSS-but-low-real-risk paper flaw. The impact is bounded to confidentiality (C:H, I:N/A:N) - attackers read/download material files but cannot modify or deny service. The only conflicting signal is the 'Authentication Bypass' tag, which misdescribes the flaw: the CWE (639) and description confirm this is an authorization/IDOR issue where auth is simply absent by design on the endpoint, not a bypass of an authentication mechanism. The effective real-world risk is gated by a configuration precondition (see exploitation_conditions), which tempers the raw 7.5.

An unauthenticated attacker locates a WordPress site running LearnPress where at least one course has 'No Required Enroll' enabled and owns a material file. They send a crafted request to the public lp-ajax-handle (load_content_via_ajax) endpoint passing the unrestricted course_id for authorization but an arbitrary item_id pointing at a lesson in a paid/enrollment-required course, and the render_material_items() handler returns that lesson's material file paths and external URLs. No POC is published, but the attack requires only standard HTTP requests and simple parameter enumeration.