Vulnerabilities / LearnPress
LearnPress vulnerabilities
Advisories WPSec published for LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. Other sources may list more. Its attack surface: LearnPress on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-17 | WPSEC-2026-1173 | LearnPress <= 4.4.10 - Authenticated (Subscriber+) Missing Authorization to Restricted Course Enrollment via JWT Checkout REST Endpoint | Medium 5.4 | 4.4.11 |
| 2026-10-17 | WPSEC-2026-1172 | LearnPress <= 4.4.10 - Unauthenticated Password Protection Bypass to Sensitive Information Exposure via REST API | Medium 5.3 | 4.4.11 |
| 2026-10-17 | WPSEC-2026-1171 | LearnPress <= 4.4.10 - Authenticated (LP Instructor+) Missing Authorization to Arbitrary Course Duplication and Permanent Deletion via Course Builder | Medium 6.3 | 4.4.11 |
| 2026-10-11 | WPSEC-2026-0769 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Authenticated (Author+) Stored Cross-Site Scripting via Question Hint and Explanation | Medium 6.4 | 4.4.10 |
| 2026-10-01 | WPSEC-2026-0199 | LearnPress <= 4.4.7 - Reflected Cross-Site Scripting via 'orderby' Parameter | Medium 6.1 | 4.4.8 |
License: CC BY 4.0