CVE-2025-11368
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.
Risk Assessment
An unauthenticated attacker can access sensitive educational content, including correct quiz answers and course materials. This may undermine the integrity of the learning process and expose protected materials.
Recommendation
Upgrade the LearnPress plugin to a version later than 4.2.9.4 containing the fix. Until patched, consider restricting access to the REST endpoint /wp-json/lp/v1/load_content_via_ajax.
Other vulnerabilities in LearnPress – WordPress LMS Plugin
See all- CVE-2026-93882High
The LearnPress – WordPress LMS Plugin for WordPress up to version 4.4.8 is vulnerable to Insecure Direct Object Reference (IDOR) via the `CourseMaterialTemplate::render_material_items()` callback exposed on the public `lp-ajax-handle` (load_content_via_ajax) endpoint. The endpoint is explicitly listed in the no-nonce allowlist and performs no capability check, and the handler decides authorization against one attacker-supplied identifier (course_id) while fetching material rows via a second, independently attacker-supplied identifier (item_id) with no check that the lesson belongs to the authorized course. This allows unauthenticated attackers to read and download course-material files (uploaded and external file paths/URLs) belonging to lessons in paid or enrollment-required courses, provided any single course on the site has 'No Required Enroll' enabled and owns at least one material file.
- CVE-2025-13956Medium
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts.
Original NVD description (English source)
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS