{
 "id": "WPSEC-2026-1601",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1601/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1601/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1601/index.md",
 "title": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Unauthenticated Session Hijacking via Unsigned Session Cookie",
 "description": "The LearnPress plugin for WordPress is vulnerable to session hijacking in all versions up to, and including, 4.4.11, due to the guest session cookie being used as the session key without any server-side signature or validation. Logged-in users' sessions are keyed by their numeric user ID, guest keys are generated from a predictable uniqid() value, and when IP-based guest sessions are enabled the key is derived from client-supplied forwarding headers. This makes it possible for unauthenticated attackers to load and modify the LearnPress session data of other users, including administrators, such as their cart, checkout email and pending order reference.",
 "plugin": {
  "slug": "learnpress",
  "name": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses",
  "full_name": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses",
  "wordpress_org": "https://wordpress.org/plugins/learnpress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/learnpress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/learnpress"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-565"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.4.12",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.4.12"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.4.12",
 "remediation": "Update to 4.4.12 or later.",
 "fix_released": "2026-10-23T09:07:13+00:00",
 "published": "2026-10-24T13:43:24+00:00",
 "updated": "2026-10-24T13:33:37.781885+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1601/",
  "https://plugins.svn.wordpress.org/learnpress/tags/4.4.12/",
  "https://wordpress.org/plugins/learnpress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/learnpress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-25"
 }
}