LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Unauthenticated Session Hijacking via Unsigned Session Cookie
- ID
- WPSEC-2026-1601
- Plugin
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (learnpress)
- Affected
- all versions before 4.4.12
- Remediation
- Update to 4.4.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-565
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-25
- Attack surface
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses on WPSec AttackSurface
- Fix released
- Published
Description
The LearnPress plugin for WordPress is vulnerable to session hijacking in all versions up to, and including, 4.4.11, due to the guest session cookie being used as the session key without any server-side signature or validation. Logged-in users' sessions are keyed by their numeric user ID, guest keys are generated from a predictable uniqid() value, and when IP-based guest sessions are enabled the key is derived from client-supplied forwarding headers. This makes it possible for unauthenticated attackers to load and modify the LearnPress session data of other users, including administrators, such as their cart, checkout email and pending order reference.
References
- https://wpsec.com/vuln/WPSEC-2026-1601/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.12/
- https://wordpress.org/plugins/learnpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS