CVE-2025-11368 is a vulnerability classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) found in the LearnPress WordPress LMS plugin, versions up to and including 4.2.9.4. The root cause is the absence of proper capability checks on the REST API endpoint /wp-json/lp/v1/load_content_via_ajax. This endpoint allows arbitrary callback execution of admin-only template methods without requiring authentication or authorization. Consequently, an unauthenticated attacker can supply valid numeric IDs to retrieve sensitive data such as admin curriculum HTML, quiz questions including correct answers, course materials, and other educational content that should be restricted to authorized users only. The vulnerability affects confidentiality but does not impact integrity or availability of the system. The CVSS v3.1 base score is 5.3 (medium severity), reflecting the ease of remote exploitation without authentication, but limited to information disclosure. No patches or official fixes have been linked yet, and no known exploits are reported in the wild. The vulnerability is significant for organizations relying on LearnPress for managing online courses, as leakage of quiz answers and course materials can undermine educational integrity and intellectual property protection.

For European organizations, especially educational institutions, e-learning platforms, and training providers using the LearnPress plugin, this vulnerability poses a risk of unauthorized disclosure of sensitive educational content. Exposure of quiz questions and correct answers can compromise the fairness and credibility of assessments. Leakage of curriculum and course materials may lead to intellectual property loss and reputational damage. Since the vulnerability requires no authentication and can be exploited remotely, attackers can harvest sensitive data at scale. This could also facilitate further social engineering or targeted attacks against educators or students. While the vulnerability does not directly affect system availability or integrity, the confidentiality breach can have significant operational and compliance implications, particularly under GDPR where unauthorized data exposure is a serious concern.

1. Immediately restrict access to the /wp-json/lp/v1/load_content_via_ajax REST endpoint by implementing IP whitelisting or authentication requirements at the web server or application firewall level. 2. Apply custom code or plugins to enforce capability checks ensuring only authorized users (e.g., admins) can access sensitive REST API endpoints. 3. Monitor REST API access logs for unusual or repeated requests to the vulnerable endpoint, especially from unauthenticated sources. 4. If possible, disable the LearnPress REST API endpoints temporarily until a vendor patch is released. 5. Engage with the plugin vendor (thimpress) to obtain or request an official patch and apply it promptly once available. 6. Educate administrators and developers about the risks of exposing sensitive data via REST APIs and review other plugins for similar misconfigurations. 7. Conduct regular security audits and penetration tests focusing on API endpoints to detect unauthorized data exposure.