LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.12 - Unauthenticated Guest Checkout Restriction Bypass
- ID
- WPSEC-2026-2321
- Plugin
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (learnpress)
- Affected
- all versions before 4.4.13
- Remediation
- Update to 4.4.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-284
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses on WPSec AttackSurface
- Fix released
- Published
Description
The LearnPress plugin for WordPress is vulnerable to an access control bypass in the checkout flow in all versions up to, and including, 4.4.12 due to the plugin not enforcing the guest checkout setting on the server side. This makes it possible for unauthenticated attackers to submit a checkout with an email address even when the site owner has disabled guest checkout, creating orders without logging in. On sites with user registration enabled, the order is assigned to the existing user with that email address, which enrolls that user in a free course. It does not give the attacker access to paid courses.
References
- https://wpsec.com/vuln/WPSEC-2026-2321/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.13/
- https://wordpress.org/plugins/learnpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS