LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.13 - Unauthenticated Sensitive Information Exposure via Cross-Course Item Access
- ID
- WPSEC-2026-3154
- Plugin
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (learnpress)
- Affected
- all versions before 4.4.14
- Remediation
- Update to 4.4.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-14
- Attack surface
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses on WPSec AttackSurface
- Fix released
- Published
Description
The LearnPress plugin for WordPress is vulnerable to Sensitive Information Exposure via course item URLs in all versions up to, and including, 4.4.13. This is due to the single course item lookup (LP_Page_Controller::setup_data_for_item_course and the block theme item template resolution) loading a lesson or quiz by its slug without checking that it belongs to the course in the URL, while access is decided by the user's access to that course. This makes it possible for unauthenticated attackers, when any course is set to not require enrollment (or authenticated users enrolled in any free course), to view the content of lessons and quizzes of other, paid or restricted courses by requesting them through that course's URL.
References
- https://wpsec.com/vuln/WPSEC-2026-3154/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.14/
- https://wordpress.org/plugins/learnpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS