CVE-2024-1289 is an authorization vulnerability in the LearnPress WordPress LMS plugin up to version 4.2.6.3. The plugin fails to properly validate user-controlled keys when retrieving order information, leading to an Insecure Direct Object Reference (IDOR). This allows authenticated users to view order data and emails belonging to other users and guests. Exploitation can result in unauthorized access to paid course enrollments originally purchased by others. No known exploits are reported in the wild, and no official patch or vendor advisory is currently provided.

An attacker with authentication can access sensitive order information and user emails belonging to other users and guests. This unauthorized access can be used to fraudulently enroll in paid courses without payment. The confidentiality and integrity of order data are compromised, but availability is not affected. The impact is limited to information disclosure and unauthorized course enrollment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access to trusted users only and monitor for suspicious activity related to order lookups. Avoid exposing the plugin to untrusted authenticated users. Follow vendor updates closely for an official patch or temporary workaround.