Learnpress
Monthly
Missing authorization in the ThimPress LearnPress WordPress plugin, affecting versions through 4.4.11, allows unauthenticated remote attackers to reach functionality that should be access-controlled and disclose data they are not entitled to read. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates no authentication, no user interaction and no non-default configuration are needed, so any internet-reachable WordPress site running an affected LearnPress release is exposed; the impact is confidentiality-only, with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is tracked by Patchstack under a broken-access-control advisory; the specific endpoint or parameter whose authorization check is missing is not described in the available sources.
Unauthenticated cross-site scripting in the LearnPress WordPress plugin through version 4.4.9 allows remote attackers to deliver script payloads that execute in a victim's browser once the victim is induced to interact with attacker-controlled input, typically by clicking a crafted link or rendering injected content produced by the plugin. No authentication is required to reach the vulnerable code (PR:N), but exploitation is not zero-click because it depends on victim interaction (UI:R); any publicly reachable WordPress site running a vulnerable LearnPress release is a candidate target in its default configuration. Patchstack reported the issue as a WordPress plugin XSS, no CISA KEV listing or EPSS score was supplied with the intelligence, and there is no public exploit identified at time of analysis.
Reflected cross-site scripting in the LearnPress WordPress plugin before 4.4.7 allows unauthenticated attackers to inject arbitrary JavaScript into a public page by luring a victim to a crafted link, with the script executing in the victim's browser under the site's origin. Because the payload lands in an unescaped HTML attribute, a logged-in administrator who opens the link can be made to run attacker-controlled code with their privileges (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1), though exploitation is contingent on victim interaction and on the site using a classic (non-block) theme. Public exploit code is available and WPScan has published an advisory, but EPSS is low at 0.22% (13th percentile) and the supplied intelligence contains no CISA KEV entry indicating confirmed active exploitation; the vendor has addressed the issue in version 4.4.7.
Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary JavaScript in the browser of a logged-in instructor or administrator who opens a crafted link, because a search parameter is reflected into an HTML attribute without escaping. Publicly available exploit code exists (published by WPScan), but there is no public exploit identified as being used in active attacks; EPSS is low at 0.15% (5th percentile). A vendor patch is available in version 4.4.1.
Broken access control in the LearnPress WordPress plugin through version 4.4.10 allows an authenticated subscriber-level user to carry out actions that should be gated behind higher privileges, yielding limited confidentiality and integrity impact (CVSS 5.4, CWE-862 Missing Authorization). The attacker must hold a subscriber account on the target site (CVSS PR:L, no user interaction), so the exposure is greatest on course platforms that allow open student/subscriber self-registration; anonymous visitors cannot exploit it directly. Reported by Patchstack, it carries a 'this_month' priority label, and no public exploit has been identified at time of analysis. The specific vulnerable feature, endpoint, or configuration is not described in the available sources.
LearnPress, the WordPress learning-management-system plugin from ThimPress, leaves access-controlled functionality reachable without proper authorization in all versions through 4.4.11, letting remote attackers retrieve restricted information from affected sites. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are needed, but the exposure is bounded: confidentiality impact is LOW while integrity and availability are unaffected, so this is information disclosure rather than account takeover or site compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority decision places it in this-month remediation rather than emergency response.
LearnPress through 4.4.11 contains a missing-authorization flaw (CWE-862, CVSS 5.4) that lets an authenticated low-privilege user perform actions outside their intended role, with limited confidentiality and integrity impact and no availability impact. The priority signal is this_month, no public exploit identified at time of analysis, and no CISA KEV entry is present, so this is a moderate rather than urgent issue; a valid account is required, although open LMS self-registration can make obtaining one easier.
LearnPress before 4.4.10 permits authenticated instructors to tamper with other instructors' courses, quizzes, and questions through legacy lp-ajax editor actions. The handlers verify a generic editor nonce but do not perform a per-object ownership or capability check, so an instructor can reuse their own nonce with another object's id to change content, alter quiz answers, or trash questions; confidentiality is not exposed per the assessed vector. The vendor has released version 4.4.10, no public exploit identified at time of analysis, and practical risk is limited to multi-instructor sites where another instructor's content is available to target.
Missing authorization in ThimPress LearnPress through 4.4.10 allows authenticated low-privilege users, such as self-registered students or subscribers, to perform actions they should not be permitted to perform against LMS-managed data. The flaw is medium severity (CVSS 5.4, CWE-862), remotely reachable with low complexity, and requires only a low-privilege authenticated account with no victim user interaction (PR:L/UI:N). No public exploit code or CISA KEV active exploitation is identified at time of analysis.
Stored cross-site scripting in the LearnPress WordPress plugin through version 4.4.9.1 allows authenticated users holding the Instructor role to inject JavaScript into quiz question hint and explanation fields through the update_question AJAX handler, where the payload is persisted and later rendered in the browser session of every student who opens the affected quiz. The root cause is missing sanitization (CWE-79) of those two fields before storage and output, which the upstream commit addresses with Template::sanitize_html_content. Exploitation is limited: it requires an Instructor-level account plus a student actually viewing the quiz, yields only script execution in the student's browser (no server compromise, no privilege escalation), and no public exploit code was identified at time of analysis; this is a genuine but moderate-severity issue rather than a drop-everything priority.
Missing authorization in the ThimPress LearnPress WordPress plugin through version 4.4.9.1 lets an authenticated low-privilege user perform plugin actions that should require higher privileges, giving a bounded integrity-only impact (CVSS 4.3). Exploitation requires a logged-in account on a site running the affected plugin - anonymous visitors cannot trigger it per the assessed vector (AV:N/AC:L/PR:L/UI:N), and there is no data disclosure or denial-of-service effect. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Authorization bypass in the ThimPress LearnPress WordPress plugin (versions through 4.4.9) allows unauthenticated remote attackers to read sensitive learner, order, or course data by manipulating a user-controlled key in an insecure direct object reference (IDOR) pattern. Assessed as medium severity (CVSS 5.3) with confidentiality-only impact; no public exploit identified at time of analysis.
Information disclosure in the LearnPress WordPress plugin before 4.4.7 allows unauthenticated remote attackers to retrieve the correct answer for every option of a quiz question, along with the instructor's accompanying explanation, from any course configured to be taken without enrolling. Exploitation is remote and requires no authentication, no user interaction and no special client, but it is gated by a non-default course setting (enrollment-free access), which is why the vendor and our assessment rate the attack complexity as high and the overall CVSS at 3.7. Publicly available exploit code exists (WPScan published the vulnerability write-up), though there is no indication of confirmed active exploitation in CISA KEV; the practical harm is limited to quiz answer-key and explanation disclosure, with no credential, PII or write-access impact.
Unauthenticated information disclosure in the LearnPress WordPress plugin affects all sites running versions from 4.2.7.1 up to but not including 4.4.7, where a REST route applies a user-supplied post status filter without checking the caller's capabilities. Any remote attacker, with no authentication or user interaction and no special configuration, can enumerate non-public course entries - drafts, pending, private, scheduled and trashed items - exposing content the site owner intended to keep hidden. Publicly available exploit code exists and the vendor has released a fix in 4.4.7, but EPSS is only 0.19% (9th percentile) and there is no confirmed active exploitation (no CISA KEV listing), making this a genuine but modest-severity exposure best treated as low-to-moderate priority; the impact is limited to disclosure of course listing metadata and does not include write access, code execution, or exposure of unrelated sensitive data.
Unauthenticated information disclosure in the LearnPress WordPress plugin (versions 4.3.2.8 through before 4.4.7) allows anyone who can determine the identifier of a previously generated order export file to download it directly and harvest customer names, purchase details, order amounts and guest email addresses. No authentication, capability check, nonce or user interaction is required once a valid export identifier is known (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7), with the High attack-complexity rating reflecting the need to discover or guess that identifier and the fact that an export must already exist on the server. Publicly available exploit code exists and the issue is tracked as EUVD-2026-80203, but there is no confirmed active exploitation (CISA KEV not applicable) and EPSS is a low 0.22% (13th percentile); this is a genuine but modest-severity data-exposure issue rather than a critical priority.
Unauthenticated information disclosure in the LearnPress WordPress plugin (versions before 4.4.7) allows any remote attacker to hit an administrative course tool that omits its capability check, listing every enrolled student's display name and user identifier for a given course and, through the same handler's search filter, recovering those students' email addresses. Publicly available exploit code exists, though the EPSS score is only 0.19% (9th percentile) and there is no CISA KEV entry, so confirmed active exploitation has not been established. The practical impact is confined to disclosure of enrolled-student PII rather than any compromise of the WordPress site or its integrity.
Unauthenticated information disclosure in the LearnPress WordPress plugin (versions 4.2.9 through before 4.4.7) lets any remote attacker query an administrative template handler that performs no capability check, returning the text, identifier, and type of every published quiz question on the site plus keyword search over that content - material the plugin otherwise keeps non-public. All default installations that actively publish LearnPress courses or quizzes are affected; no authentication, user interaction, or non-default configuration is required, as confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N vector. Publicly available exploit code exists and WPScan has published the vulnerability, though EPSS is only 0.19% (9th percentile), and the independent assessment rates this a genuine but low-severity information disclosure issue rather than a high-priority emergency; a vendor patch is available in 4.4.7.
Stored cross-site scripting in LearnPress WordPress Plugin before 4.4.6 allows authenticated Instructor-role users to inject persistent JavaScript through quiz question answer title fields, with payloads executing in the browsers of any user who views the affected quiz - including administrators. The unescaped HTML sink means stored payloads persist until patched, making every quiz viewer a potential victim regardless of their privilege level. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but the admin-targeting capability meaningfully elevates practical impact beyond the medium CVSS score.
Broken object-level authorization in the LearnPress WordPress LMS plugin before 4.4.6 allows authenticated Instructor-role users to inject quiz answers into questions owned by other instructors. The answer-insertion endpoint accepts arbitrary question identifiers without verifying ownership, enabling persistent cross-instructor content tampering. No public exploit is identified and the vulnerability is not listed in CISA KEV; a patched version (4.4.6) is available.
Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authenticated user - including low-privilege subscribers - to retrieve lesson material from courses they have not purchased or enrolled in. The flaw resides in the plugin's AI-assistant feature, which processes lesson content requests without first verifying the requesting user's enrollment status, exposing an authorization bypass at the content-serving layer. With a publicly available proof-of-concept from WPScan and a 15% EPSS score, this is a realistic and low-barrier threat to any WordPress e-learning deployment running an affected version.
LearnPress WordPress plugin before version 4.4.4 exposes a blind, bounded server-side request forgery (SSRF) exploitable by users holding the instructor role, allowing the WordPress server to issue HTTP requests to arbitrary external hosts chosen by the attacker. Reported by WPScan and tracked under CWE-918, the flaw stems from absent URL validation on a user-controllable input. A public proof-of-concept exists; however, EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate negligible observed exploitation activity, consistent with the high-privilege requirement.
LearnPress WordPress plugin versions prior to 4.3.7 expose sensitive user account metadata to unauthenticated visitors through a REST API endpoint that fails to enforce the required `edit_users` capability gate on its `edit` context. Any unauthenticated caller can issue a crafted REST request and receive each user's roles, full capabilities map, extra capabilities, locale, and registration date - data that enables targeted follow-on attacks against privileged accounts. A publicly available exploit exists per WPScan disclosure, and SSVC classifies exploitation as automatable; however, no public exploit identified at time of analysis has reached CISA KEV status, and EPSS remains at 0.16% (6th percentile), suggesting limited observed mass exploitation despite low attack complexity.
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.7.5 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.0%.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.0%.
SQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to inject arbitrary SQL via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST endpoint, enabling extraction of sensitive database contents including user credentials and PII. Publicly available exploit code exists, and the EPSS score of 88.05% (99th percentile) indicates very high real-world exploitation likelihood, though the issue is not currently listed in CISA KEV.
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.2.6.8.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 4.2.6.9.3 due to insufficient. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'render_content_block_template' function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenticated attackers to append arbitrary SQL to a backend query via the term_id parameter, enabling extraction of sensitive database contents such as user credentials and session data. Publicly available exploit code exists and the EPSS score of 77.09% (99th percentile) indicates a very high probability of opportunistic exploitation against exposed WordPress sites running this plugin.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to, and including, 4.2.6.5 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to, and including,. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 91.3%.
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 82.3%.
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization in the ThimPress LearnPress WordPress plugin, affecting versions through 4.4.11, allows unauthenticated remote attackers to reach functionality that should be access-controlled and disclose data they are not entitled to read. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates no authentication, no user interaction and no non-default configuration are needed, so any internet-reachable WordPress site running an affected LearnPress release is exposed; the impact is confidentiality-only, with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is tracked by Patchstack under a broken-access-control advisory; the specific endpoint or parameter whose authorization check is missing is not described in the available sources.
Unauthenticated cross-site scripting in the LearnPress WordPress plugin through version 4.4.9 allows remote attackers to deliver script payloads that execute in a victim's browser once the victim is induced to interact with attacker-controlled input, typically by clicking a crafted link or rendering injected content produced by the plugin. No authentication is required to reach the vulnerable code (PR:N), but exploitation is not zero-click because it depends on victim interaction (UI:R); any publicly reachable WordPress site running a vulnerable LearnPress release is a candidate target in its default configuration. Patchstack reported the issue as a WordPress plugin XSS, no CISA KEV listing or EPSS score was supplied with the intelligence, and there is no public exploit identified at time of analysis.
Reflected cross-site scripting in the LearnPress WordPress plugin before 4.4.7 allows unauthenticated attackers to inject arbitrary JavaScript into a public page by luring a victim to a crafted link, with the script executing in the victim's browser under the site's origin. Because the payload lands in an unescaped HTML attribute, a logged-in administrator who opens the link can be made to run attacker-controlled code with their privileges (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1), though exploitation is contingent on victim interaction and on the site using a classic (non-block) theme. Public exploit code is available and WPScan has published an advisory, but EPSS is low at 0.22% (13th percentile) and the supplied intelligence contains no CISA KEV entry indicating confirmed active exploitation; the vendor has addressed the issue in version 4.4.7.
Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary JavaScript in the browser of a logged-in instructor or administrator who opens a crafted link, because a search parameter is reflected into an HTML attribute without escaping. Publicly available exploit code exists (published by WPScan), but there is no public exploit identified as being used in active attacks; EPSS is low at 0.15% (5th percentile). A vendor patch is available in version 4.4.1.
Broken access control in the LearnPress WordPress plugin through version 4.4.10 allows an authenticated subscriber-level user to carry out actions that should be gated behind higher privileges, yielding limited confidentiality and integrity impact (CVSS 5.4, CWE-862 Missing Authorization). The attacker must hold a subscriber account on the target site (CVSS PR:L, no user interaction), so the exposure is greatest on course platforms that allow open student/subscriber self-registration; anonymous visitors cannot exploit it directly. Reported by Patchstack, it carries a 'this_month' priority label, and no public exploit has been identified at time of analysis. The specific vulnerable feature, endpoint, or configuration is not described in the available sources.
LearnPress, the WordPress learning-management-system plugin from ThimPress, leaves access-controlled functionality reachable without proper authorization in all versions through 4.4.11, letting remote attackers retrieve restricted information from affected sites. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are needed, but the exposure is bounded: confidentiality impact is LOW while integrity and availability are unaffected, so this is information disclosure rather than account takeover or site compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority decision places it in this-month remediation rather than emergency response.
LearnPress through 4.4.11 contains a missing-authorization flaw (CWE-862, CVSS 5.4) that lets an authenticated low-privilege user perform actions outside their intended role, with limited confidentiality and integrity impact and no availability impact. The priority signal is this_month, no public exploit identified at time of analysis, and no CISA KEV entry is present, so this is a moderate rather than urgent issue; a valid account is required, although open LMS self-registration can make obtaining one easier.
LearnPress before 4.4.10 permits authenticated instructors to tamper with other instructors' courses, quizzes, and questions through legacy lp-ajax editor actions. The handlers verify a generic editor nonce but do not perform a per-object ownership or capability check, so an instructor can reuse their own nonce with another object's id to change content, alter quiz answers, or trash questions; confidentiality is not exposed per the assessed vector. The vendor has released version 4.4.10, no public exploit identified at time of analysis, and practical risk is limited to multi-instructor sites where another instructor's content is available to target.
Missing authorization in ThimPress LearnPress through 4.4.10 allows authenticated low-privilege users, such as self-registered students or subscribers, to perform actions they should not be permitted to perform against LMS-managed data. The flaw is medium severity (CVSS 5.4, CWE-862), remotely reachable with low complexity, and requires only a low-privilege authenticated account with no victim user interaction (PR:L/UI:N). No public exploit code or CISA KEV active exploitation is identified at time of analysis.
Stored cross-site scripting in the LearnPress WordPress plugin through version 4.4.9.1 allows authenticated users holding the Instructor role to inject JavaScript into quiz question hint and explanation fields through the update_question AJAX handler, where the payload is persisted and later rendered in the browser session of every student who opens the affected quiz. The root cause is missing sanitization (CWE-79) of those two fields before storage and output, which the upstream commit addresses with Template::sanitize_html_content. Exploitation is limited: it requires an Instructor-level account plus a student actually viewing the quiz, yields only script execution in the student's browser (no server compromise, no privilege escalation), and no public exploit code was identified at time of analysis; this is a genuine but moderate-severity issue rather than a drop-everything priority.
Missing authorization in the ThimPress LearnPress WordPress plugin through version 4.4.9.1 lets an authenticated low-privilege user perform plugin actions that should require higher privileges, giving a bounded integrity-only impact (CVSS 4.3). Exploitation requires a logged-in account on a site running the affected plugin - anonymous visitors cannot trigger it per the assessed vector (AV:N/AC:L/PR:L/UI:N), and there is no data disclosure or denial-of-service effect. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Authorization bypass in the ThimPress LearnPress WordPress plugin (versions through 4.4.9) allows unauthenticated remote attackers to read sensitive learner, order, or course data by manipulating a user-controlled key in an insecure direct object reference (IDOR) pattern. Assessed as medium severity (CVSS 5.3) with confidentiality-only impact; no public exploit identified at time of analysis.
Information disclosure in the LearnPress WordPress plugin before 4.4.7 allows unauthenticated remote attackers to retrieve the correct answer for every option of a quiz question, along with the instructor's accompanying explanation, from any course configured to be taken without enrolling. Exploitation is remote and requires no authentication, no user interaction and no special client, but it is gated by a non-default course setting (enrollment-free access), which is why the vendor and our assessment rate the attack complexity as high and the overall CVSS at 3.7. Publicly available exploit code exists (WPScan published the vulnerability write-up), though there is no indication of confirmed active exploitation in CISA KEV; the practical harm is limited to quiz answer-key and explanation disclosure, with no credential, PII or write-access impact.
Unauthenticated information disclosure in the LearnPress WordPress plugin affects all sites running versions from 4.2.7.1 up to but not including 4.4.7, where a REST route applies a user-supplied post status filter without checking the caller's capabilities. Any remote attacker, with no authentication or user interaction and no special configuration, can enumerate non-public course entries - drafts, pending, private, scheduled and trashed items - exposing content the site owner intended to keep hidden. Publicly available exploit code exists and the vendor has released a fix in 4.4.7, but EPSS is only 0.19% (9th percentile) and there is no confirmed active exploitation (no CISA KEV listing), making this a genuine but modest-severity exposure best treated as low-to-moderate priority; the impact is limited to disclosure of course listing metadata and does not include write access, code execution, or exposure of unrelated sensitive data.
Unauthenticated information disclosure in the LearnPress WordPress plugin (versions 4.3.2.8 through before 4.4.7) allows anyone who can determine the identifier of a previously generated order export file to download it directly and harvest customer names, purchase details, order amounts and guest email addresses. No authentication, capability check, nonce or user interaction is required once a valid export identifier is known (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7), with the High attack-complexity rating reflecting the need to discover or guess that identifier and the fact that an export must already exist on the server. Publicly available exploit code exists and the issue is tracked as EUVD-2026-80203, but there is no confirmed active exploitation (CISA KEV not applicable) and EPSS is a low 0.22% (13th percentile); this is a genuine but modest-severity data-exposure issue rather than a critical priority.
Unauthenticated information disclosure in the LearnPress WordPress plugin (versions before 4.4.7) allows any remote attacker to hit an administrative course tool that omits its capability check, listing every enrolled student's display name and user identifier for a given course and, through the same handler's search filter, recovering those students' email addresses. Publicly available exploit code exists, though the EPSS score is only 0.19% (9th percentile) and there is no CISA KEV entry, so confirmed active exploitation has not been established. The practical impact is confined to disclosure of enrolled-student PII rather than any compromise of the WordPress site or its integrity.
Unauthenticated information disclosure in the LearnPress WordPress plugin (versions 4.2.9 through before 4.4.7) lets any remote attacker query an administrative template handler that performs no capability check, returning the text, identifier, and type of every published quiz question on the site plus keyword search over that content - material the plugin otherwise keeps non-public. All default installations that actively publish LearnPress courses or quizzes are affected; no authentication, user interaction, or non-default configuration is required, as confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N vector. Publicly available exploit code exists and WPScan has published the vulnerability, though EPSS is only 0.19% (9th percentile), and the independent assessment rates this a genuine but low-severity information disclosure issue rather than a high-priority emergency; a vendor patch is available in 4.4.7.
Stored cross-site scripting in LearnPress WordPress Plugin before 4.4.6 allows authenticated Instructor-role users to inject persistent JavaScript through quiz question answer title fields, with payloads executing in the browsers of any user who views the affected quiz - including administrators. The unescaped HTML sink means stored payloads persist until patched, making every quiz viewer a potential victim regardless of their privilege level. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but the admin-targeting capability meaningfully elevates practical impact beyond the medium CVSS score.
Broken object-level authorization in the LearnPress WordPress LMS plugin before 4.4.6 allows authenticated Instructor-role users to inject quiz answers into questions owned by other instructors. The answer-insertion endpoint accepts arbitrary question identifiers without verifying ownership, enabling persistent cross-instructor content tampering. No public exploit is identified and the vulnerability is not listed in CISA KEV; a patched version (4.4.6) is available.
Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authenticated user - including low-privilege subscribers - to retrieve lesson material from courses they have not purchased or enrolled in. The flaw resides in the plugin's AI-assistant feature, which processes lesson content requests without first verifying the requesting user's enrollment status, exposing an authorization bypass at the content-serving layer. With a publicly available proof-of-concept from WPScan and a 15% EPSS score, this is a realistic and low-barrier threat to any WordPress e-learning deployment running an affected version.
LearnPress WordPress plugin before version 4.4.4 exposes a blind, bounded server-side request forgery (SSRF) exploitable by users holding the instructor role, allowing the WordPress server to issue HTTP requests to arbitrary external hosts chosen by the attacker. Reported by WPScan and tracked under CWE-918, the flaw stems from absent URL validation on a user-controllable input. A public proof-of-concept exists; however, EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate negligible observed exploitation activity, consistent with the high-privilege requirement.
LearnPress WordPress plugin versions prior to 4.3.7 expose sensitive user account metadata to unauthenticated visitors through a REST API endpoint that fails to enforce the required `edit_users` capability gate on its `edit` context. Any unauthenticated caller can issue a crafted REST request and receive each user's roles, full capabilities map, extra capabilities, locale, and registration date - data that enables targeted follow-on attacks against privileged accounts. A publicly available exploit exists per WPScan disclosure, and SSVC classifies exploitation as automatable; however, no public exploit identified at time of analysis has reached CISA KEV status, and EPSS remains at 0.16% (6th percentile), suggesting limited observed mass exploitation despite low attack complexity.
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.7.5 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.0%.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.0%.
SQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to inject arbitrary SQL via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST endpoint, enabling extraction of sensitive database contents including user credentials and PII. Publicly available exploit code exists, and the EPSS score of 88.05% (99th percentile) indicates very high real-world exploitation likelihood, though the issue is not currently listed in CISA KEV.
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.2.6.8.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 4.2.6.9.3 due to insufficient. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'render_content_block_template' function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenticated attackers to append arbitrary SQL to a backend query via the term_id parameter, enabling extraction of sensitive database contents such as user credentials and session data. Publicly available exploit code exists and the EPSS score of 77.09% (99th percentile) indicates a very high probability of opportunistic exploitation against exposed WordPress sites running this plugin.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to, and including, 4.2.6.5 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to, and including,. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 91.3%.
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 82.3%.
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.