LearnPress – WordPress LMS Plugin vulnerabilities

The LearnPress – WordPress LMS Plugin for WordPress up to version 4.4.8 is vulnerable to Insecure Direct Object Reference (IDOR) via the `CourseMaterialTemplate::render_material_items()` callback exposed on the public `lp-ajax-handle` (load_content_via_ajax) endpoint. The endpoint is explicitly listed in the no-nonce allowlist and performs no capability check, and the handler decides authorization against one attacker-supplied identifier (course_id) while fetching material rows via a second, independently attacker-supplied identifier (item_id) with no check that the lesson belongs to the authorized course. This allows unauthenticated attackers to read and download course-material files (uploaded and external file paths/URLs) belonging to lessons in paid or enrollment-required courses, provided any single course on the site has 'No Required Enroll' enabled and owns at least one material file.

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts.

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.