# LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Unauthenticated Session Hijacking via Unsigned Session Cookie

- **ID:** WPSEC-2026-1601
- **Plugin:** LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (`learnpress`), https://wordpress.org/plugins/learnpress/
- **Affected versions:** all versions before 4.4.12
- **Fixed in:** 4.4.12 (Update to 4.4.12 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-565
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/learnpress
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1601/

## Description

The LearnPress plugin for WordPress is vulnerable to session hijacking in all versions up to, and including, 4.4.11, due to the guest session cookie being used as the session key without any server-side signature or validation. Logged-in users' sessions are keyed by their numeric user ID, guest keys are generated from a predictable uniqid() value, and when IP-based guest sessions are enabled the key is derived from client-supplied forwarding headers. This makes it possible for unauthenticated attackers to load and modify the LearnPress session data of other users, including administrators, such as their cart, checkout email and pending order reference.

## References

- https://wpsec.com/vuln/WPSEC-2026-1601/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.12/
- https://wordpress.org/plugins/learnpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1601/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.