# LearnPress <= 4.4.10 - Authenticated (Subscriber+) Missing Authorization to Restricted Course Enrollment via JWT Checkout REST Endpoint

- **ID:** WPSEC-2026-1173
- **Plugin:** LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (`learnpress`), https://wordpress.org/plugins/learnpress/
- **Affected versions:** all versions before 4.4.11
- **Fixed in:** 4.4.11 (Update to 4.4.11 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/learnpress
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1173/

## Description

The LearnPress plugin for WordPress is vulnerable to unauthorized course enrollment via the learnpress/v1/checkout REST endpoints in all versions up to, and including, 4.4.10. This is due to the process_checkout and paypal_create_order handlers creating and, for free courses, completing an order without calling CourseModel::can_enroll() or can_purchase(). This makes it possible for authenticated attackers, with subscriber-level access and above, to enroll in free courses that the enrollment rules should block, such as unpublished (draft or pending) courses, courses that have reached their student limit, and external courses, and so to reach their content.

## References

- https://wpsec.com/vuln/WPSEC-2026-1173/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.11/
- https://wordpress.org/plugins/learnpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1173/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.