CVE-2025-11368: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.
AI Analysis
Technical Summary
CVE-2025-11368 is a sensitive information disclosure vulnerability in the LearnPress WordPress LMS Plugin for creating and selling online courses. The issue arises from missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax, which permits unauthenticated users to invoke admin-only template methods arbitrarily. This flaw enables attackers to retrieve sensitive educational content such as admin curriculum HTML, quiz questions with correct answers, and course materials by providing valid numeric IDs to the endpoint. The vulnerability affects all versions up to and including 4.2.9.4. The CVSS 3.1 score is 5.3, indicating a medium severity impact primarily due to confidentiality loss without integrity or availability impact.
Potential Impact
An unauthenticated attacker can access sensitive information intended only for administrators or authorized users, including curriculum details, quiz questions with correct answers, and course materials. This exposure could undermine the integrity of educational content and assessments by revealing answers and proprietary course data. There is no indication of impact on system integrity or availability. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API endpoint if possible through custom access controls or firewall rules. Monitor vendor communications for updates and apply patches promptly once released.
CVE-2025-11368: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Description
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-11368 is a sensitive information disclosure vulnerability in the LearnPress WordPress LMS Plugin for creating and selling online courses. The issue arises from missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax, which permits unauthenticated users to invoke admin-only template methods arbitrarily. This flaw enables attackers to retrieve sensitive educational content such as admin curriculum HTML, quiz questions with correct answers, and course materials by providing valid numeric IDs to the endpoint. The vulnerability affects all versions up to and including 4.2.9.4. The CVSS 3.1 score is 5.3, indicating a medium severity impact primarily due to confidentiality loss without integrity or availability impact.
Potential Impact
An unauthenticated attacker can access sensitive information intended only for administrators or authorized users, including curriculum details, quiz questions with correct answers, and course materials. This exposure could undermine the integrity of educational content and assessments by revealing answers and proprietary course data. There is no indication of impact on system integrity or availability. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API endpoint if possible through custom access controls or firewall rules. Monitor vendor communications for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-10-06T13:47:47.518Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 691ffc17a535ade79490ffb1
Added to database: 11/21/2025, 5:43:51 AM
Last enriched: 4/9/2026, 8:50:06 PM
Last updated: 5/10/2026, 1:29:50 AM
Views: 156
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.