CVE-2025-14802 is an authorization bypass vulnerability classified under CWE-639 (Authorization Bypass Through User-Controlled Key) found in the LearnPress WordPress LMS plugin, versions up to and including 4.3.2.2. The vulnerability exists in the REST API DELETE endpoint /wp-json/lp/v1/material/{file_id}, which is designed to delete lesson material files. The core issue stems from a parameter mismatch: the DELETE operation uses the file_id parameter from the URL path to identify the file to delete, but the authorization check validates permissions against an item_id parameter supplied in the request body. This discrepancy allows an authenticated user with teacher-level access to craft a DELETE request where they supply their own item_id (passing the authorization check) but specify a different file_id in the URL path, enabling them to delete files uploaded by other teachers. Since the attacker must be authenticated as a teacher, the attack surface is limited to users with elevated privileges but does not require administrator access. The vulnerability impacts the integrity and availability of lesson materials, potentially disrupting course content and user experience. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, no confidentiality impact, but partial integrity and availability impact. No public exploits are known at this time. The vulnerability was published on January 7, 2026, and no official patch links are currently available, indicating that organizations must monitor vendor updates closely. The issue highlights the importance of consistent parameter validation in REST API endpoints to prevent authorization bypass scenarios.

For European organizations using the LearnPress plugin to manage e-learning content, this vulnerability poses a risk to the integrity and availability of educational materials. Unauthorized deletion of lesson files by teacher-level users could disrupt course delivery, cause data loss, and degrade the learning experience. Although confidentiality is not directly impacted, the loss or tampering of course content can lead to reputational damage, loss of trust from students and educators, and potential operational downtime. Organizations relying heavily on LearnPress for critical training or certification programs may face significant disruption. Additionally, the vulnerability could be exploited internally by disgruntled employees or malicious insiders with teacher privileges. The medium severity score suggests a moderate risk, but the impact could be amplified in environments with many teacher accounts or insufficient monitoring. European educational institutions, corporate training departments, and e-learning service providers should be particularly vigilant. The lack of known exploits in the wild reduces immediate risk but does not eliminate the threat, especially as attackers often develop exploits after public disclosure.

1. Monitor the LearnPress plugin vendor announcements and apply security patches promptly once available to address CVE-2025-14802. 2. Until a patch is released, restrict teacher-level permissions to the minimum necessary, potentially limiting file deletion capabilities or reviewing role assignments to reduce the number of users with such privileges. 3. Implement Web Application Firewall (WAF) rules to detect and block suspicious DELETE requests to the /wp-json/lp/v1/material/ endpoint, especially those where the file_id and item_id parameters do not match expected patterns. 4. Enable detailed logging and monitoring of REST API calls related to lesson material management to detect anomalous deletion attempts. 5. Conduct regular audits of user roles and permissions within WordPress to ensure no unauthorized privilege escalation. 6. Educate teachers and administrators about the risk and encourage reporting of unexpected content deletions. 7. Consider isolating critical course content backups and enabling versioning to allow recovery from unauthorized deletions. 8. If feasible, temporarily disable the vulnerable REST API endpoint or restrict access to it via IP whitelisting or authentication enhancements until the patch is applied.