The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses contains a missing authorization vulnerability (CWE-862) affecting all versions up to 4.3.6. An unauthenticated attacker can exploit the 'return_type' and 'c_status' parameters in a single request to the /wp-json/lp/v1/courses/archive-course REST API endpoint to bypass post status restrictions and retrieve sensitive data. This includes plaintext post_password fields of password-protected courses and the full post_content, post_author, and post_name fields of unpublished draft, private, and pending courses. The vulnerability arises from an unrestricted SELECT * fallback query that exposes sensitive course data without proper access control.

The vulnerability allows disclosure of sensitive information such as plaintext passwords for protected courses and detailed content of unpublished courses. This exposure could lead to unauthorized access to course materials and potentially compromise course confidentiality. The CVSS score of 5.3 reflects a medium impact primarily due to information disclosure without direct integrity or availability impact. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected REST API endpoint where possible, for example by implementing authentication or IP-based access controls. Monitor vendor communications for updates and apply patches promptly once available.