The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses contains an unprotected alternate channel vulnerability (CWE-420) in its 'create_account' function within the checkout process. This flaw allows unauthenticated users to register accounts with the default role despite registration being disabled on the site. The vulnerability affects all versions up to 4.2.6.5. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, resulting in limited confidentiality impact but no integrity or availability impact.

An attacker can create user accounts on a vulnerable LearnPress installation without authentication and even when registration is disabled. This could allow unauthorized access to site features available to the default user role, potentially leading to unauthorized actions or information disclosure limited to that role's permissions. There is no direct impact on data integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or restricting access to the checkout process or user registration workflows in LearnPress, or apply custom code to enforce registration checks. Monitor vendor channels for updates and apply official patches promptly once available.