Threat database

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions up to and including 4.4.10 contain an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to enumerate all site users and extract their full email addresses, including those of administrators, by exploiting improper authorization checks.

LearnPress WordPress plugin versions up to 4.4.10 are vulnerable to PHP Object Injection via deserialization of untrusted input from the 'checkout-email' parameter during checkout AJAX requests. The plugin improperly unserializes data without restricting allowed classes, enabling unauthenticated attackers to inject malicious PHP objects. This vulnerability has a critical severity with a CVSS score of 9.8.

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions up to and including 4.4.10 are vulnerable to stored cross-site scripting (XSS) via the 'quantity (REST)' and 'order_comments (checkout)' parameters. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The attack can be performed without authentication if guest checkout is enabled; otherwise, a Subscriber-level user can exploit it through their own checkout process.

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

LearnPress plugin for WordPress versions up to 4.4.9.1 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with the Instructor role can inject malicious scripts via quiz question hint and explanation fields. These scripts execute in the context of students taking the quiz, potentially compromising their sessions.

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVE-2026-104403 is an authorization bypass vulnerability in ThimPress LearnPress that arises from user-controlled keys allowing incorrect access control. It affects LearnPress versions up to 4.4.9. The vulnerability has a medium severity with a CVSS score of 5.3 and does not require user interaction or privileges to exploit. There is no information about available patches or vendor advisories at this time.

LearnPress – WordPress LMS Plugin versions up to 4.4.8 contains an authorization bypass vulnerability due to insecure direct object references. This flaw allows unauthenticated attackers to access and download course material files from paid or enrollment-required courses if any course on the site has 'No Required Enroll' enabled. The vulnerability arises because the AJAX endpoint lp-ajax-handle (load_content_via_ajax) does not perform capability checks and authorizes access based on one attacker-controlled identifier while fetching data using another unchecked identifier.

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions up to 4.3.9.1 contain a stored cross-site scripting (XSS) vulnerability via the 'layout_custom_css' parameter. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The issue arises from insufficient input sanitization and output escaping.

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary JavaScript through the answer title parameter, which is rendered through an unescaped HTML sink to execute in the browsers of any user who views the affected quiz question, including students, other instructors, and administrators.

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's order_by property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

LearnPress WordPress LMS plugin versions up to 4.4.4 contain a missing authorization vulnerability allowing authenticated users with Editor-level access to modify arbitrary WordPress options via an AJAX action. This can lead to unauthorized changes such as enabling public user registration or corrupting active plugins, impacting site integrity.

Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.

WP Hotel Booking plugin for WordPress versions up to and including 2.3.2 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'widget_search' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users access the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation depends on browsers supporting access keys, as the payload is stored in a hidden attribute. The CVSS score is 6.4, indicating a medium severity.

Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.