# LearnPress <= 4.4.10 - Authenticated (LP Instructor+) Missing Authorization to Arbitrary Course Duplication and Permanent Deletion via Course Builder

- **ID:** WPSEC-2026-1171
- **Plugin:** LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (`learnpress`), https://wordpress.org/plugins/learnpress/
- **Affected versions:** from 4.3.6 before 4.4.11
- **Fixed in:** 4.4.11 (Update to 4.4.11 or later.)
- **Severity:** Medium 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/learnpress
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1171/

## Description

The LearnPress plugin for WordPress is vulnerable to unauthorized access and modification of data via the Course Builder quick edit AJAX action (cb_quick_edit_save_course) in versions 4.3.6 up to, and including, 4.4.10. This is due to a missing course-level capability check: CBEditCourseAjax::check_valid_course() only verifies that the user is an instructor and loads any course by the supplied course_id, and the 'duplicate' and 'delete' actions do not check whether the user may edit or delete that course (PostModel::delete() permanently deletes the post without a delete_post check). This makes it possible for authenticated attackers, with LP Instructor-level access and above, to duplicate any other instructor's course, including unpublished ones, into a copy they own, and to permanently delete other instructors' courses that are in the trash.

## References

- https://wpsec.com/vuln/WPSEC-2026-1171/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.11/
- https://wordpress.org/plugins/learnpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1171/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.