CVE-2026-93882
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The LearnPress – WordPress LMS Plugin for WordPress up to version 4.4.8 is vulnerable to Insecure Direct Object Reference (IDOR) via the `CourseMaterialTemplate::render_material_items()` callback exposed on the public `lp-ajax-handle` (load_content_via_ajax) endpoint. The endpoint is explicitly listed in the no-nonce allowlist and performs no capability check, and the handler decides authorization against one attacker-supplied identifier (course_id) while fetching material rows via a second, independently attacker-supplied identifier (item_id) with no check that the lesson belongs to the authorized course. This allows unauthenticated attackers to read and download course-material files (uploaded and external file paths/URLs) belonging to lessons in paid or enrollment-required courses, provided any single course on the site has 'No Required Enroll' enabled and owns at least one material file.
Risk Assessment
An unauthenticated attacker can access course materials that should be protected, potentially leading to confidentiality breaches of educational and financial data.
Recommendation
Update the LearnPress plugin to the latest patched version. Also ensure the `lp-ajax-handle` endpoint is properly secured and does not allow unauthorized access.
Other vulnerabilities in LearnPress – WordPress LMS Plugin
See all- CVE-2025-13956Medium
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts.
- CVE-2025-11368Medium
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.
Original NVD description (English source)
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::render_material_items() callback exposed on the public lp-ajax-handle (load_content_via_ajax) endpoint. The endpoint is explicitly listed in the AbstractAjax no-nonce allowlist and performs no capability check, and the render_material_items() handler decides authorization against one attacker-supplied identifier (course_id) while fetching the returned material rows via a second, independently attacker-supplied identifier (item_id) with no check that the lesson belongs to the authorized course. This makes it possible for unauthenticated attackers to read and download course-material files (uploaded and external file paths/URLs) belonging to lessons in paid or enrollment-required courses, provided any single course on the site has 'No Required Enroll' enabled and owns at least one material file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS