The LearnPress WordPress LMS Plugin suffers from a missing capability check in the catch_lp_ajax function, enabling unauthorized users to modify course content without authentication. This vulnerability affects all versions up to and including 4.3.2. The lack of authorization controls allows attackers to manipulate course sections and items, potentially impacting the integrity of course data. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity.

The vulnerability allows unauthenticated attackers to modify course contents by adding, removing, updating, or reordering sections or section items. This compromises the integrity of course data but does not affect confidentiality or availability. There are no known exploits in the wild, and the impact is limited to unauthorized content modification within the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's AJAX endpoints where possible and monitor for suspicious activity related to course content modifications. Avoid using affected versions in production environments if possible.