# LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.13 - Unauthenticated Arbitrary Shortcode Execution via Course Archive URL Parameters

- **ID:** WPSEC-2026-3151
- **Plugin:** LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (`learnpress`), https://wordpress.org/plugins/learnpress/
- **Affected versions:** from 4.2.5.7 before 4.4.14
- **Fixed in:** 4.4.14 (Update to 4.4.14 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/learnpress
- **Fix released:** 2026-11-14
- **Published:** 2026-11-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3151/

## Description

The LearnPress plugin for WordPress is vulnerable to arbitrary shortcode execution via course list URL parameters in all versions from 4.2.5.7 up to, and including, 4.4.13. This is due to the course list templates (Elementor courses widget, Gutenberg list courses block, course archive) copying every query string parameter into the arguments of TemplateAJAX::load_content_via_ajax(). Those arguments are written into the data-send attribute without neutralizing square brackets, and the html_* loading arguments are printed as they are. The output is later processed by do_shortcode() when it is part of post content. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

## References

- https://wpsec.com/vuln/WPSEC-2026-3151/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.14/
- https://wordpress.org/plugins/learnpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3151/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.