CVE-2026-115599

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

The LearnPress plugin for WordPress in versions up to and including 4.4.10 is vulnerable to PHP Object Injection via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value passes through sanitize_text_field(), which does not strip serialized object syntax, is stored in the LearnPress session table, and later fed to unserialize() without an allowed_classes restriction.

The LearnPress WordPress plugin in versions up to 4.4.10 contains a Broken Access Control vulnerability accessible to subscriber-level users. It allows performing actions beyond the granted permissions.

The LearnPress plugin for WordPress in versions up to and including 4.4.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The flaw enables unauthorized access to functions that should be protected.

The LearnPress plugin for WordPress in versions up to and including 4.4.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The flaw enables unauthorized access to functions that should be protected.

The LearnPress plugin up to version 4.4.10 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.

The LearnPress – WordPress LMS Plugin for WordPress in versions up to and including 4.4.10 is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter due to insufficient input sanitization and output escaping. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors.

LearnPress plugin in versions up to and including 4.4.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.

The LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.

The LearnPress plugin for WordPress up to version 4.4.7 is vulnerable to reflected DOM-based XSS via the 'orderby' parameter. Unauthenticated attackers can inject scripts that execute when a user clicks a crafted link.