{
 "id": "WPSEC-2026-3151",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3151/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3151/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3151/index.md",
 "title": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.13 - Unauthenticated Arbitrary Shortcode Execution via Course Archive URL Parameters",
 "description": "The LearnPress plugin for WordPress is vulnerable to arbitrary shortcode execution via course list URL parameters in all versions from 4.2.5.7 up to, and including, 4.4.13. This is due to the course list templates (Elementor courses widget, Gutenberg list courses block, course archive) copying every query string parameter into the arguments of TemplateAJAX::load_content_via_ajax(). Those arguments are written into the data-send attribute without neutralizing square brackets, and the html_* loading arguments are printed as they are. The output is later processed by do_shortcode() when it is part of post content. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.",
 "plugin": {
  "slug": "learnpress",
  "name": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses",
  "full_name": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses",
  "wordpress_org": "https://wordpress.org/plugins/learnpress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/learnpress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/learnpress"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.2.5.7",
    "from_inclusive": true,
    "to": "4.4.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.2.5.7 before 4.4.14"
  ]
 },
 "introduced_in": "4.2.5.7",
 "fixed_in": "4.4.14",
 "remediation": "Update to 4.4.14 or later.",
 "fix_released": "2026-11-14T02:40:48+00:00",
 "published": "2026-11-15T02:40:51+00:00",
 "updated": "2026-11-14T16:16:39.601333+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3151/",
  "https://plugins.svn.wordpress.org/learnpress/tags/4.4.14/",
  "https://wordpress.org/plugins/learnpress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/learnpress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-14"
 }
}