{
 "id": "WPSEC-2026-1173",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1173/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1173/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1173/index.md",
 "title": "LearnPress <= 4.4.10 - Authenticated (Subscriber+) Missing Authorization to Restricted Course Enrollment via JWT Checkout REST Endpoint",
 "description": "The LearnPress plugin for WordPress is vulnerable to unauthorized course enrollment via the learnpress/v1/checkout REST endpoints in all versions up to, and including, 4.4.10. This is due to the process_checkout and paypal_create_order handlers creating and, for free courses, completing an order without calling CourseModel::can_enroll() or can_purchase(). This makes it possible for authenticated attackers, with subscriber-level access and above, to enroll in free courses that the enrollment rules should block, such as unpublished (draft or pending) courses, courses that have reached their student limit, and external courses, and so to reach their content.",
 "plugin": {
  "slug": "learnpress",
  "name": "LearnPress",
  "full_name": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses",
  "wordpress_org": "https://wordpress.org/plugins/learnpress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/learnpress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/learnpress"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.4.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.4.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.4.11",
 "remediation": "Update to 4.4.11 or later.",
 "fix_released": "2026-10-16T09:11:33+00:00",
 "published": "2026-10-17T09:45:54+00:00",
 "updated": "2026-10-17T09:16:08.035785+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1173/",
  "https://plugins.svn.wordpress.org/learnpress/tags/4.4.11/",
  "https://wordpress.org/plugins/learnpress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/learnpress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-17"
 }
}