{
 "id": "WPSEC-2026-2321",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2321/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2321/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2321/index.md",
 "title": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.12 - Unauthenticated Guest Checkout Restriction Bypass",
 "description": "The LearnPress plugin for WordPress is vulnerable to an access control bypass in the checkout flow in all versions up to, and including, 4.4.12 due to the plugin not enforcing the guest checkout setting on the server side. This makes it possible for unauthenticated attackers to submit a checkout with an email address even when the site owner has disabled guest checkout, creating orders without logging in. On sites with user registration enabled, the order is assigned to the existing user with that email address, which enrolls that user in a free course. It does not give the attacker access to paid courses.",
 "plugin": {
  "slug": "learnpress",
  "name": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses",
  "full_name": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses",
  "wordpress_org": "https://wordpress.org/plugins/learnpress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/learnpress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/learnpress"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-284"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.4.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.4.13"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.4.13",
 "remediation": "Update to 4.4.13 or later.",
 "fix_released": "2026-10-30T10:41:33+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:04.329887+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2321/",
  "https://plugins.svn.wordpress.org/learnpress/tags/4.4.13/",
  "https://wordpress.org/plugins/learnpress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/learnpress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}