LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.13 - Unauthenticated Arbitrary Shortcode Execution via Course Archive URL Parameters
- ID
- WPSEC-2026-3151
- Plugin
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (learnpress)
- Affected
- from 4.2.5.7 before 4.4.14
- Remediation
- Update to 4.4.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-14
- Attack surface
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses on WPSec AttackSurface
- Fix released
- Published
Description
The LearnPress plugin for WordPress is vulnerable to arbitrary shortcode execution via course list URL parameters in all versions from 4.2.5.7 up to, and including, 4.4.13. This is due to the course list templates (Elementor courses widget, Gutenberg list courses block, course archive) copying every query string parameter into the arguments of TemplateAJAX::load_content_via_ajax(). Those arguments are written into the data-send attribute without neutralizing square brackets, and the html_* loading arguments are printed as they are. The output is later processed by do_shortcode() when it is part of post content. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
References
- https://wpsec.com/vuln/WPSEC-2026-3151/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.14/
- https://wordpress.org/plugins/learnpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS