LearnDash vulnerabilities and threats

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.8	EPSS 0.5%	CVE-2026-16310MemberDash (WordPress plugin) · Insecure Direct Object Reference Critical9.8EPSS 0.5%2026-09-06CVE Database V5CVE-2026-16310 The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim. EPSS 0.5%Vulnerability LearnDash CWE-639 #ghsa-2rc8-vf7f-v3hx	CVE Database V5	2026-09-06
Medium	5.3	EPSS 0.3%	CVE-2025-24662LearnDash LMS (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.3%2025-01-27CVE Database V5CVE-2025-24662 Missing Authorization vulnerability in LearnDash LearnDash LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnDash LMS: from n/a through 4.20.0.1. EPSS 0.3%Vulnerability CWE-862	CVE Database V5	2025-01-27

Page 1 of 1