LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

Software Type	Plugin
Software Slug	learnpress (view on wordpress.org)
Software Status	Active
Software Author	thimpress
Software Website	thimpress.com
Software Downloads	6,250,241
Software Active Installs	70,000
Software Record Last Updated	July 21, 2026

Showing 1-20 of 71 Vulnerabilities

Submit a Vulnerability

LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints

7.5

CVE-2026-13765

Jul 16, 2026

Researcher: 이성민

LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute

6.4

CVE-2026-12732

Jun 30, 2026

Researchers: zaim, PRISM

LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter

6.5

CVE-2026-11988

Jun 30, 2026

Researcher: javitoia

LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters

5.3

CVE-2026-8502

Jun 5, 2026

Researcher: Jamshed Yergashvoyev (CVE Guy)

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting

6.1

CVE-2026-48865

Jun 1, 2026

Researcher: VanTastic

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter

4.3

CVE-2026-7648

May 13, 2026

Researcher: winrace

LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion

9.1

CVE-2026-4365

Apr 13, 2026

Researcher: Supakiad S. (m3ez)

LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute

6.4

CVE-2026-4333

Apr 7, 2026

Researcher: zaim

LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion

4.3

CVE-2026-3225

Mar 23, 2026

Researcher: Jack Pas (Dark.)

LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering

4.3

CVE-2026-3226

Mar 11, 2026

Researcher: Jack Pas (Dark.)

LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API

5.3

CVE-2025-14798

Jan 19, 2026

Researcher: andrea bocchetti

LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion

5.4

CVE-2025-14802

Jan 6, 2026

Researcher: Deniz Mert (dennywise)

LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification

5.3

CVE-2025-13964

Jan 5, 2026

Researcher: Supakiad S. (m3ez)

LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure

5.3

CVE-2025-13956

Dec 15, 2025

Researcher: Sarawut Poolkhet (MisterHelloz)

LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social

6.4

CVE-2025-14387

Dec 15, 2025

Researcher: Arkadiusz Hydzik

LearnPress <= 4.2.9.4 - Missing Authorization

5.3

CVE-2025-66054

Nov 30, 2025

Researcher: benzdeus

LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure

5.3

CVE-2025-11368

Nov 20, 2025

Researcher: Lucas Montes (NiRoX)

LearnPress <= 4.2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2025-67536

Nov 6, 2025

Researcher: Peter Thaleikis

LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation

6.5

CVE-2025-11372

Oct 17, 2025

Researcher: Lucas Montes (NiRoX)

LearnPress <= 4.2.7.5 - Missing Authorization

5.3

CVE-2025-22739

Mar 27, 2025

Researcher: David Ojeda Guijarro

Title	Status	CVE ID	CVSS	Researchers	Date
LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints	Patched	CVE-2026-13765	7.5	이성민	July 16, 2026
LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute	Patched	CVE-2026-12732	6.4	zaim, PRISM	June 30, 2026
LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter	Patched	CVE-2026-11988	6.5	javitoia	June 30, 2026
LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters	Patched	CVE-2026-8502	5.3	Jamshed Yergashvoyev (CVE Guy)	June 5, 2026
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting	Patched	CVE-2026-48865	6.1	VanTastic	June 1, 2026
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter	Patched	CVE-2026-7648	4.3	winrace	May 13, 2026
LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion	Patched	CVE-2026-4365	9.1	Supakiad S. (m3ez)	April 13, 2026
LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute	Patched	CVE-2026-4333	6.4	zaim	April 7, 2026
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion	Patched	CVE-2026-3225	4.3	Jack Pas (Dark.)	March 23, 2026
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering	Patched	CVE-2026-3226	4.3	Jack Pas (Dark.)	March 11, 2026
LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API	Patched	CVE-2025-14798	5.3	andrea bocchetti	January 19, 2026
LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion	Patched	CVE-2025-14802	5.4	Deniz Mert (dennywise)	January 6, 2026
LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification	Patched	CVE-2025-13964	5.3	Supakiad S. (m3ez)	January 5, 2026
LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure	Patched	CVE-2025-13956	5.3	Sarawut Poolkhet (MisterHelloz)	December 15, 2025
LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social	Patched	CVE-2025-14387	6.4	Arkadiusz Hydzik	December 15, 2025
LearnPress <= 4.2.9.4 - Missing Authorization	Patched	CVE-2025-66054	5.3	benzdeus	November 30, 2025
LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure	Patched	CVE-2025-11368	5.3	Lucas Montes (NiRoX)	November 20, 2025
LearnPress <= 4.2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2025-67536	6.4	Peter Thaleikis	November 6, 2025
LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation	Patched	CVE-2025-11372	6.5	Lucas Montes (NiRoX)	October 17, 2025
LearnPress <= 4.2.7.5 - Missing Authorization	Patched	CVE-2025-22739	5.3	David Ojeda Guijarro	March 27, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation