LearnPress vulnerabilities

LearnPress plugin in versions up to and including 4.4.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.

The LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.

The LearnPress plugin for WordPress up to version 4.4.7 is vulnerable to reflected DOM-based XSS via the 'orderby' parameter. Unauthenticated attackers can inject scripts that execute when a user clicks a crafted link.

Missing authorization vulnerability in the LearnPress WordPress plugin, allowing exploitation of incorrectly configured access control security levels.

Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows exploiting incorrectly configured access control security levels. This issue affects LearnPress from n/a through 4.4.9.

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes. Unauthenticated attackers can list courses that are not published, including draft, pending, private, scheduled and trashed ones.

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file. Unauthenticated attackers who can determine its identifier can download customer names, purchases, amounts and guest email addresses.

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools. Unauthenticated attackers can list every enrolled student's display name and user identifier against the course they are enrolled on, and recover their email addresses through the same handler's search filter.

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers. Unauthenticated attackers can retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page. Unauthenticated attackers can execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block mode are affected.

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to and including 4.3.9.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary JavaScript through the answer title parameter, which is rendered through an unescaped HTML sink to execute in the browsers of any user who views the affected quiz question, including students, other instructors, and administrators.

The LearnPress WordPress plugin before version 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors. A missing ownership check on the answer insertion path lets attackers supply arbitrary question identifiers and bypass instructor-boundary restrictions.

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's order_by property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to and including 4.4.4 via the learnpress_create_page AJAX action. Attackers with Editor-level access can update arbitrary options, such as users_can_register or active_plugins, potentially enabling public registration or breaking the site.

The LearnPress WordPress plugin before version 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.

The LearnPress WordPress plugin before version 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting (XSS). An attacker can exploit this vulnerability to execute a malicious script in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.

The LearnPress WordPress LMS plugin up to version 4.4.1 is vulnerable to sensitive information exposure via the check_answer function. Unauthenticated attackers can extract correct answer markers, full option lists, explanations, and question content for any quiz question, including those from paid courses the attacker is not enrolled in.

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to and including 4.4.0. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts that execute when users visit the affected page.

The LearnPress WordPress LMS plugin up to version 4.3.9.1 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'userId' parameter. An authenticated attacker with subscriber-level access or higher can view course enrollment progress and completion data belonging to instructors and administrators.

The LearnPress plugin for WordPress up to version 4.3.6 exposes sensitive data via the 'return_type' parameter. An unauthenticated attacker can extract passwords for protected courses and content, author, and name of unpublished posts.

LearnPress WordPress plugin is vulnerable to Reflected XSS due to improper input neutralization during page generation. Affects versions up to 4.3.6.

The LearnPress – WordPress LMS Plugin is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. Insufficient input sanitization and output escaping on the 'skin' attribute allows authenticated attackers (Contributor-level and above) to inject arbitrary web scripts.

The LearnPress – WordPress LMS Plugin is vulnerable to unauthorized file deletion in versions up to and including 4.3.2.2 via the /wp-json/lp/v1/material/{file_id} REST API endpoint. A parameter mismatch between DELETE operation and authorization check allows authenticated attackers with teacher-level access to delete lesson material files uploaded by other teachers.

The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 4.3.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress learnpress allows Stored XSS. This issue affects LearnPress: from n/a through <= 4.2.9.4.

The LearnPress WordPress LMS Plugin up to version 4.2.9.2 is vulnerable to data modification due to missing capability checks on Admin Tools REST endpoints, which have permission_callback set to __return_true. This allows unauthenticated attackers to perform destructive database operations, including dropping indexes on any table (including WordPress core tables), creating duplicate configuration entries, and degrading site performance.