LearnPress <= 4.4.10 - Authenticated (Subscriber+) Missing Authorization to Restricted Course Enrollment via JWT Checkout REST Endpoint
- ID
- WPSEC-2026-1173
- Plugin
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (learnpress)
- Affected
- all versions before 4.4.11
- Remediation
- Update to 4.4.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-17
- Attack surface
- LearnPress on WPSec AttackSurface
- Fix released
- Published
Description
The LearnPress plugin for WordPress is vulnerable to unauthorized course enrollment via the learnpress/v1/checkout REST endpoints in all versions up to, and including, 4.4.10. This is due to the process_checkout and paypal_create_order handlers creating and, for free courses, completing an order without calling CourseModel::can_enroll() or can_purchase(). This makes it possible for authenticated attackers, with subscriber-level access and above, to enroll in free courses that the enrollment rules should block, such as unpublished (draft or pending) courses, courses that have reached their student limit, and external courses, and so to reach their content.
References
- https://wpsec.com/vuln/WPSEC-2026-1173/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.11/
- https://wordpress.org/plugins/learnpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS