# LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.12 - Unauthenticated Guest Checkout Restriction Bypass

- **ID:** WPSEC-2026-2321
- **Plugin:** LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (`learnpress`), https://wordpress.org/plugins/learnpress/
- **Affected versions:** all versions before 4.4.13
- **Fixed in:** 4.4.13 (Update to 4.4.13 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-284
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/learnpress
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2321/

## Description

The LearnPress plugin for WordPress is vulnerable to an access control bypass in the checkout flow in all versions up to, and including, 4.4.12 due to the plugin not enforcing the guest checkout setting on the server side. This makes it possible for unauthenticated attackers to submit a checkout with an email address even when the site owner has disabled guest checkout, creating orders without logging in. On sites with user registration enabled, the order is assigned to the existing user with that email address, which enrolls that user in a free course. It does not give the attacker access to paid courses.

## References

- https://wpsec.com/vuln/WPSEC-2026-2321/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.13/
- https://wordpress.org/plugins/learnpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2321/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.