The LearnPress WordPress LMS Plugin suffers from an authorization bypass vulnerability (CWE-639) in its REST API DELETE endpoint for lesson materials. The endpoint uses the file_id parameter from the URL path to identify the file to delete, but the permission callback incorrectly validates authorization based on item_id from the request body. Authenticated users with teacher privileges can exploit this mismatch by providing their own item_id to pass authorization checks while specifying another teacher's file_id in the URL, thereby deleting files they should not have access to. This vulnerability affects versions up to and including 4.3.2.2.

An authenticated user with teacher-level privileges can delete arbitrary lesson material files uploaded by other teachers. This results in unauthorized modification of course content, causing integrity and availability impacts on the affected LMS materials. There is no indication of confidentiality impact. The CVSS score is 5.4 (medium severity), reflecting low attack complexity and limited privileges required but no confidentiality loss.

Patch status is not yet confirmed — no official patch or vendor advisory is provided in the available data. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, restrict teacher-level access to trusted users only and consider disabling or restricting access to the vulnerable REST API endpoint if possible.