Learnpress Wordpress Lms Plugin For Create And Sell Online Courses
Monthly
Unauthenticated PHP object injection in the LearnPress WordPress LMS plugin through version 4.4.10 allows attackers to store a crafted serialized object via the checkout-email parameter, which LearnPress later deserializes without an allowed_classes restriction. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but practical high-impact exploitation depends on a usable POP gadget chain in LearnPress, WordPress core, or another installed plugin/theme; no public exploit has been identified at time of analysis.
Stored cross-site scripting in the LearnPress WordPress LMS plugin (all versions up to and including 4.4.10) lets attackers plant arbitrary JavaScript that executes in a store administrator's browser when they open the affected order details or invoice export screens in wp-admin. Two injection points exist: the 'quantity' parameter handled by the frontend REST courses controller and the 'order_comments' field captured during checkout; the unauthenticated path depends on the site having guest checkout enabled, while sites with guest checkout disabled still expose both vectors to any Subscriber-level account. CISA KEV does not list this issue and no public exploit identified at time of analysis; exploitation requires the victimized operator to view a poisoned order or invoice page, which keeps it a credible but moderate-priority risk despite a 7.2 CVSS score reflecting scope change into the admin context.
Unauthenticated attackers can read and download course-material files - including uploaded file paths and external URLs - belonging to lessons in paid or enrollment-required LearnPress courses by exploiting an insecure direct object reference in the plugin's CourseMaterialTemplate::render_material_items() handler (CVE-2026-93882, CVSS 7.5, AV:N/AC:L/PR:N/UI:N). The handler validates authorization against one attacker-supplied identifier (course_id) but fetches material rows using a second, independently attacker-supplied identifier (item_id), with no check that the lesson actually belongs to the authorized course; the call is reachable through the public lp-ajax-handle (load_content_via_ajax) action, which sits on the AbstractAjax no-nonce allowlist and performs no capability check. Exploitation is conditional: at least one course on the target site must have 'No Required Enroll' enabled and own at least one material file, so that a valid course_id exists to satisfy the authorization branch while item_id is pointed at a restricted lesson. Impact is read-only confidentiality loss; no public exploit identified at time of analysis.
Sensitive information exposure in the LearnPress LMS plugin for WordPress (versions up to and including 4.4.1) lets unauthenticated attackers pull correct-answer markers, complete option lists, explanations, and full question content for any quiz on the site through the check_answer logic in its frontend REST API. This exposes graded assessment material for paid courses the attacker never enrolled in or paid for, defeating the plugin's course-access model. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the network-facing, no-authentication nature makes it trivially reproducible against affected sites.
Unauthenticated data deletion in LearnPress WordPress LMS plugin (versions ≤4.3.2.8) allows remote attackers to delete arbitrary quiz answer options without authentication. The plugin exposes wp_rest nonces to unauthenticated visitors in public frontend HTML and uses this nonce as the sole security gate for its AJAX dispatcher, while the delete_question_answer() function lacks both capability and ownership verification. With CVSS 9.1 (Critical) scoring and network-exploitable attack vector requi
An authorization bypass in the LearnPress WordPress LMS plugin (all versions through 4.4.10) lets any authenticated user with subscriber-level access or above abuse the plugin's user-search handler as a character-by-character oracle, reconstructing the full site user roster and the complete email address of any account, including administrators. Because LearnPress is a course-selling plugin that commonly permits open registration, the PR:L prerequisite is often trivially satisfied; no user interaction or additional configuration is required. The issue is a bounded confidentiality problem (C:H, no integrity or availability impact) and no public exploit code or CISA KEV entry was identified at time of analysis, though upstream fix work is visible in the plugin's Trac repository.
LearnPress WordPress LMS plugin versions through 4.4.7 reflect unsanitized input from the 'orderby' parameter into the DOM, allowing reflected DOM-based cross-site scripting. An unauthenticated attacker can craft a URL that, when a victim clicks or loads it, executes arbitrary script in the victim's browser session; the CVSS vector confirms PR:N and UI:R, with low confidentiality and integrity impact and no availability impact. This is a moderate-severity, interaction-dependent issue, and no public exploit identified at time of analysis.
Stored cross-site scripting in LearnPress - WordPress LMS Plugin versions through 4.3.9.1 allows authenticated contributors to inject persistent malicious scripts via the 'layout_custom_css' parameter in the Elementor instructor list widget. The payload is written to the database and executes silently in the browser of any subsequent visitor, including administrators, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit or CISA KEV listing has been identified; version 4.4.0 resolves the issue.
SQL injection in the LearnPress WordPress LMS plugin (versions ≤ 4.4.4) allows authenticated administrators to extract arbitrary data from the WordPress database by injecting into the ORDER BY clause of the export_order_csv AJAX action. The flaw exists because the 'orderby' parameter is only partially normalized - only the literal strings 'date' and 'title' are whitelisted - and all other attacker-controlled values are concatenated directly into a raw SQL query inside DataBase::execute() without $wpdb->prepare() or an identifier allowlist. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high privilege barrier as the primary risk limiter.
Unauthorized option-write in LearnPress (WordPress LMS plugin) versions up to and including 4.4.4 allows authenticated attackers with Editor-level access to overwrite arbitrary WordPress site options with a page ID integer via the learnpress_create_page AJAX endpoint. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce - both granted to Editors - but applies no allowlist to the field_name parameter before it is forwarded to update_option(). Exploiting this flaw, an attacker can enable open user registration, corrupt the active plugin list to deny service, or manipulate other administrator-reserved settings. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Stored Cross-Site Scripting in the LearnPress WordPress LMS plugin (versions up to and including 4.4.0) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the unescaped 'class_wrapper_form' shortcode attribute. The payload persists in the database and executes in the browser of any visitor - including administrators - who loads the affected page, enabling session hijacking, credential harvesting, or privilege escalation through forged admin actions. No CISA KEV listing or public exploit code has been identified at time of analysis, but the Wordfence advisory includes precise code-level references that substantially lower the bar for independent reproduction.
Course enrollment data exposure in LearnPress WordPress LMS plugin (all versions through 4.3.9.1) enables authenticated subscribers to read the course progress and completion records of any instructor or administrator by supplying an arbitrary value to the `userId` REST API parameter. The lazy load controller accepts the caller-supplied key without verifying ownership, bypassing authorization for LP_TEACHER_ROLE and administrator accounts while a partial guard correctly blocks subscriber-to-subscriber cross-access. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires only a subscriber-level account, making the real-world barrier low on sites with open user registration.
Sensitive information exposure in LearnPress WordPress LMS Plugin (all versions through 4.3.6) allows unauthenticated remote attackers to extract plaintext passwords and unpublished course content via a crafted REST API request. The /wp-json/lp/v1/courses/archive-course endpoint accepts two query parameters - c_status=all and return_type=json - that together bypass a publish-only post_status filter and suppress a safe DISTINCT(ID) field override, triggering an unrestricted SELECT * fallback query against the WordPress posts table. Exposed data includes post_password in plaintext for password-protected courses, and post_content, post_author, and post_name for draft, private, and pending courses. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the unauthenticated, low-complexity attack vector makes it trivially scriptable at scale.
Payment bypass in LearnPress WordPress LMS Plugin (all versions ≤ 4.3.5) allows authenticated subscribers to enroll in any paid course at zero cost by manipulating a REST API parameter. The flaw stems from improper input handling in the add_to_cart() REST API endpoint where PHP's array_merge() permits attacker-supplied values to silently overwrite hardcoded order defaults - specifically the quantity field - causing the order total to resolve to $0 and bypassing all configured payment gateway enforcement. No public exploit code has been identified at time of analysis, and CISA KEV does not list this vulnerability; SSVC and EPSS both signal low current exploitation pressure, though the low-friction exploit path warrants prompt remediation on revenue-generating LMS deployments.
Stored Cross-Site Scripting in LearnPress WordPress LMS Plugin up to version 4.3.3 allows authenticated contributors to inject malicious scripts via the 'skin' attribute of the learn_press_courses shortcode, which lacks proper output escaping. The injected scripts execute whenever any user visits a page containing the malicious shortcode, affecting all sites using vulnerable versions. No evidence of active exploitation exists at time of analysis.
The LearnPress WordPress LMS Plugin contains a missing capability check vulnerability in the delete_question_answer() function that allows authenticated attackers with Subscriber-level privileges to delete quiz answer options without authorization. Affected versions include 4.3.2.8 and earlier; the vulnerability was patched in version 4.3.3. While the CVSS score is moderate (4.3), the attack requires only low-privilege authentication and no user interaction, making it practical for any authenticated site user to exploit.
Unauthenticated PHP object injection in the LearnPress WordPress LMS plugin through version 4.4.10 allows attackers to store a crafted serialized object via the checkout-email parameter, which LearnPress later deserializes without an allowed_classes restriction. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but practical high-impact exploitation depends on a usable POP gadget chain in LearnPress, WordPress core, or another installed plugin/theme; no public exploit has been identified at time of analysis.
Stored cross-site scripting in the LearnPress WordPress LMS plugin (all versions up to and including 4.4.10) lets attackers plant arbitrary JavaScript that executes in a store administrator's browser when they open the affected order details or invoice export screens in wp-admin. Two injection points exist: the 'quantity' parameter handled by the frontend REST courses controller and the 'order_comments' field captured during checkout; the unauthenticated path depends on the site having guest checkout enabled, while sites with guest checkout disabled still expose both vectors to any Subscriber-level account. CISA KEV does not list this issue and no public exploit identified at time of analysis; exploitation requires the victimized operator to view a poisoned order or invoice page, which keeps it a credible but moderate-priority risk despite a 7.2 CVSS score reflecting scope change into the admin context.
Unauthenticated attackers can read and download course-material files - including uploaded file paths and external URLs - belonging to lessons in paid or enrollment-required LearnPress courses by exploiting an insecure direct object reference in the plugin's CourseMaterialTemplate::render_material_items() handler (CVE-2026-93882, CVSS 7.5, AV:N/AC:L/PR:N/UI:N). The handler validates authorization against one attacker-supplied identifier (course_id) but fetches material rows using a second, independently attacker-supplied identifier (item_id), with no check that the lesson actually belongs to the authorized course; the call is reachable through the public lp-ajax-handle (load_content_via_ajax) action, which sits on the AbstractAjax no-nonce allowlist and performs no capability check. Exploitation is conditional: at least one course on the target site must have 'No Required Enroll' enabled and own at least one material file, so that a valid course_id exists to satisfy the authorization branch while item_id is pointed at a restricted lesson. Impact is read-only confidentiality loss; no public exploit identified at time of analysis.
Sensitive information exposure in the LearnPress LMS plugin for WordPress (versions up to and including 4.4.1) lets unauthenticated attackers pull correct-answer markers, complete option lists, explanations, and full question content for any quiz on the site through the check_answer logic in its frontend REST API. This exposes graded assessment material for paid courses the attacker never enrolled in or paid for, defeating the plugin's course-access model. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the network-facing, no-authentication nature makes it trivially reproducible against affected sites.
Unauthenticated data deletion in LearnPress WordPress LMS plugin (versions ≤4.3.2.8) allows remote attackers to delete arbitrary quiz answer options without authentication. The plugin exposes wp_rest nonces to unauthenticated visitors in public frontend HTML and uses this nonce as the sole security gate for its AJAX dispatcher, while the delete_question_answer() function lacks both capability and ownership verification. With CVSS 9.1 (Critical) scoring and network-exploitable attack vector requi
An authorization bypass in the LearnPress WordPress LMS plugin (all versions through 4.4.10) lets any authenticated user with subscriber-level access or above abuse the plugin's user-search handler as a character-by-character oracle, reconstructing the full site user roster and the complete email address of any account, including administrators. Because LearnPress is a course-selling plugin that commonly permits open registration, the PR:L prerequisite is often trivially satisfied; no user interaction or additional configuration is required. The issue is a bounded confidentiality problem (C:H, no integrity or availability impact) and no public exploit code or CISA KEV entry was identified at time of analysis, though upstream fix work is visible in the plugin's Trac repository.
LearnPress WordPress LMS plugin versions through 4.4.7 reflect unsanitized input from the 'orderby' parameter into the DOM, allowing reflected DOM-based cross-site scripting. An unauthenticated attacker can craft a URL that, when a victim clicks or loads it, executes arbitrary script in the victim's browser session; the CVSS vector confirms PR:N and UI:R, with low confidentiality and integrity impact and no availability impact. This is a moderate-severity, interaction-dependent issue, and no public exploit identified at time of analysis.
Stored cross-site scripting in LearnPress - WordPress LMS Plugin versions through 4.3.9.1 allows authenticated contributors to inject persistent malicious scripts via the 'layout_custom_css' parameter in the Elementor instructor list widget. The payload is written to the database and executes silently in the browser of any subsequent visitor, including administrators, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit or CISA KEV listing has been identified; version 4.4.0 resolves the issue.
SQL injection in the LearnPress WordPress LMS plugin (versions ≤ 4.4.4) allows authenticated administrators to extract arbitrary data from the WordPress database by injecting into the ORDER BY clause of the export_order_csv AJAX action. The flaw exists because the 'orderby' parameter is only partially normalized - only the literal strings 'date' and 'title' are whitelisted - and all other attacker-controlled values are concatenated directly into a raw SQL query inside DataBase::execute() without $wpdb->prepare() or an identifier allowlist. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high privilege barrier as the primary risk limiter.
Unauthorized option-write in LearnPress (WordPress LMS plugin) versions up to and including 4.4.4 allows authenticated attackers with Editor-level access to overwrite arbitrary WordPress site options with a page ID integer via the learnpress_create_page AJAX endpoint. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce - both granted to Editors - but applies no allowlist to the field_name parameter before it is forwarded to update_option(). Exploiting this flaw, an attacker can enable open user registration, corrupt the active plugin list to deny service, or manipulate other administrator-reserved settings. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Stored Cross-Site Scripting in the LearnPress WordPress LMS plugin (versions up to and including 4.4.0) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the unescaped 'class_wrapper_form' shortcode attribute. The payload persists in the database and executes in the browser of any visitor - including administrators - who loads the affected page, enabling session hijacking, credential harvesting, or privilege escalation through forged admin actions. No CISA KEV listing or public exploit code has been identified at time of analysis, but the Wordfence advisory includes precise code-level references that substantially lower the bar for independent reproduction.
Course enrollment data exposure in LearnPress WordPress LMS plugin (all versions through 4.3.9.1) enables authenticated subscribers to read the course progress and completion records of any instructor or administrator by supplying an arbitrary value to the `userId` REST API parameter. The lazy load controller accepts the caller-supplied key without verifying ownership, bypassing authorization for LP_TEACHER_ROLE and administrator accounts while a partial guard correctly blocks subscriber-to-subscriber cross-access. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires only a subscriber-level account, making the real-world barrier low on sites with open user registration.
Sensitive information exposure in LearnPress WordPress LMS Plugin (all versions through 4.3.6) allows unauthenticated remote attackers to extract plaintext passwords and unpublished course content via a crafted REST API request. The /wp-json/lp/v1/courses/archive-course endpoint accepts two query parameters - c_status=all and return_type=json - that together bypass a publish-only post_status filter and suppress a safe DISTINCT(ID) field override, triggering an unrestricted SELECT * fallback query against the WordPress posts table. Exposed data includes post_password in plaintext for password-protected courses, and post_content, post_author, and post_name for draft, private, and pending courses. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the unauthenticated, low-complexity attack vector makes it trivially scriptable at scale.
Payment bypass in LearnPress WordPress LMS Plugin (all versions ≤ 4.3.5) allows authenticated subscribers to enroll in any paid course at zero cost by manipulating a REST API parameter. The flaw stems from improper input handling in the add_to_cart() REST API endpoint where PHP's array_merge() permits attacker-supplied values to silently overwrite hardcoded order defaults - specifically the quantity field - causing the order total to resolve to $0 and bypassing all configured payment gateway enforcement. No public exploit code has been identified at time of analysis, and CISA KEV does not list this vulnerability; SSVC and EPSS both signal low current exploitation pressure, though the low-friction exploit path warrants prompt remediation on revenue-generating LMS deployments.
Stored Cross-Site Scripting in LearnPress WordPress LMS Plugin up to version 4.3.3 allows authenticated contributors to inject malicious scripts via the 'skin' attribute of the learn_press_courses shortcode, which lacks proper output escaping. The injected scripts execute whenever any user visits a page containing the malicious shortcode, affecting all sites using vulnerable versions. No evidence of active exploitation exists at time of analysis.
The LearnPress WordPress LMS Plugin contains a missing capability check vulnerability in the delete_question_answer() function that allows authenticated attackers with Subscriber-level privileges to delete quiz answer options without authorization. Affected versions include 4.3.2.8 and earlier; the vulnerability was patched in version 4.3.3. While the CVSS score is moderate (4.3), the attack requires only low-privilege authentication and no user interaction, making it practical for any authenticated site user to exploit.