CVE-2026-93882 describes an insecure direct object reference (IDOR) vulnerability in the LearnPress WordPress LMS Plugin (<=4.4.8). The vulnerability exists in the CourseMaterialTemplate::render_material_items() function, which is exposed via the public lp-ajax-handle endpoint (load_content_via_ajax). This endpoint is on a no-nonce allowlist and performs no capability checks. Authorization is incorrectly based on a single attacker-controlled course_id, while the material rows are fetched using a separate attacker-controlled item_id without verifying that the lesson belongs to the authorized course. This flaw enables unauthenticated attackers to read and download course materials from lessons in paid or enrollment-required courses, provided any course on the site has 'No Required Enroll' enabled and contains at least one material file.

An unauthenticated attacker can bypass authorization controls to access and download protected course materials from paid or enrollment-required courses. This results in unauthorized disclosure of potentially sensitive or paid content, impacting confidentiality. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should consider disabling courses with 'No Required Enroll' enabled or restricting access to the vulnerable AJAX endpoint. Monitor vendor channels for updates and apply patches promptly once released.