CVE-2026-75982: CWE-862 Missing Authorization in thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to and including 4.4.4 via the learnpress_create_page AJAX action. The vulnerability arises because the LP_Admin_Ajax::create_page() handler only verifies the edit_pages capability and a wp_rest nonce, both accessible to Editors, but does not restrict the field_name parameter to a safe allow-list. This parameter is used as the option key in update_option(), enabling attackers with Editor privileges to update arbitrary options to a positive integer (a newly created page ID). This can be exploited to change critical site settings such as enabling public user registration or corrupting active plugins, which are normally restricted to administrators.

Authenticated users with Editor-level privileges can modify arbitrary WordPress options, potentially enabling public user registration, breaking site functionality by corrupting active plugins, or otherwise tampering with site-wide settings. This compromises site integrity and administrative control without requiring administrator privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Editor-level access to trusted users only and monitor for suspicious changes to WordPress options. Consider applying custom code to restrict the field_name parameter or disable the vulnerable AJAX action if feasible.