LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

Information

Software Type Plugin
Software Slug learnpress (view on wordpress.org)
Software Status Active
Software Author thimpress
Software Website thimpress.com
Software Downloads 6,369,121
Software Active Installs 70,000
Software Record Last Updated September 7, 2026

Showing 1-20 of 77 Vulnerabilities

Submit a Vulnerability
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-12976
Aug 13, 2026
Researcher: Yaswanth Reddy Sunkara
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter
4.3
CVE-2026-7648
May 13, 2026
Researcher: winrace
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
4.3
CVE-2026-3225
Mar 23, 2026
Researcher: AlexHenry
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
4.3
CVE-2026-3226
Mar 11, 2026
Researcher: AlexHenry
LearnPress <= 4.2.6.8.2 - Cross-Site Request Forgery
4.3
CVE-2024-39641
Aug 1, 2024
Researcher: Rafie Muhammad
LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure
4.3
CVE-2023-6223
Jan 2, 2024
Researcher: lttn
LearnPress <= 4.1.4.1 - Arbitrary Image Renaming
4.3
CVE-2022-0377
Jan 26, 2022
Researcher: Ceylan Bozogullarindan
LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
4.4
CVE-2026-75982
Aug 24, 2026
Researcher: Wordfence PRISM
LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-13127
Jan 29, 2025
Researcher: Dmitrii Ignatyev
LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-10010
Nov 21, 2024
Researcher: Dmitrii Ignatyev
LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-9881
Nov 21, 2024
Researcher: Bob Matyas
LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting
4.4
CVE-2024-1463
Apr 4, 2024
Researcher: drop
LearnPress <= 4.1.3 - Authenticated Stored Cross-Site Scripting
4.8
CVE-2021-24702
Sep 20, 2021
Researcher: Shivam Rai
LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
4.9
CVE-2026-77823
Aug 31, 2026
Researcher: Wordfence PRISM
LearnPress <= 4.3.6 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure
5.3
CVE-2026-8383
Jun 27, 2026
Researcher: dyingman1
LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters
5.3
CVE-2026-8502
Jun 5, 2026
Researcher: Jamshed Yergashvoyev (CVE Guy)
LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API
5.3
CVE-2025-14798
Jan 19, 2026
Researcher: andrea bocchetti
LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification
5.3
CVE-2025-13964
Jan 5, 2026
Researcher: Supakiad S. (m3ez)
LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
5.3
CVE-2025-13956
Dec 15, 2025
Researcher: Sarawut Poolkhet (MisterHelloz)
LearnPress <= 4.2.9.4 - Missing Authorization
5.3
CVE-2025-66054
Nov 30, 2025
Researcher: benzdeus
Title Status CVE ID CVSS Researchers Date
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure Patched CVE-2026-12976 4.3 Yaswanth Reddy Sunkara August 13, 2026
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter Patched CVE-2026-7648 4.3 winrace May 13, 2026
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion Patched CVE-2026-3225 4.3 AlexHenry March 23, 2026
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering Patched CVE-2026-3226 4.3 AlexHenry March 11, 2026
LearnPress <= 4.2.6.8.2 - Cross-Site Request Forgery Patched CVE-2024-39641 4.3 Rafie Muhammad August 1, 2024
LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure Patched CVE-2023-6223 4.3 lttn January 2, 2024
LearnPress <= 4.1.4.1 - Arbitrary Image Renaming Patched CVE-2022-0377 4.3 Ceylan Bozogullarindan January 26, 2022
LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter Patched CVE-2026-75982 4.4 Wordfence PRISM August 24, 2026
LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2024-13127 4.4 Dmitrii Ignatyev January 29, 2025
LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2024-10010 4.4 Dmitrii Ignatyev November 21, 2024
LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2024-9881 4.4 Bob Matyas November 21, 2024
LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting Patched CVE-2024-1463 4.4 drop April 4, 2024
LearnPress <= 4.1.3 - Authenticated Stored Cross-Site Scripting Patched CVE-2021-24702 4.8 Shivam Rai September 20, 2021
LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter Patched CVE-2026-77823 4.9 Wordfence PRISM August 31, 2026
LearnPress <= 4.3.6 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure Patched CVE-2026-8383 5.3 dyingman1 June 27, 2026
LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters Patched CVE-2026-8502 5.3 Jamshed Yergashvoyev (CVE Guy) June 5, 2026
LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API Patched CVE-2025-14798 5.3 andrea bocchetti January 19, 2026
LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification Patched CVE-2025-13964 5.3 Supakiad S. (m3ez) January 5, 2026
LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure Patched CVE-2025-13956 5.3 Sarawut Poolkhet (MisterHelloz) December 15, 2025
LearnPress <= 4.2.9.4 - Missing Authorization Patched CVE-2025-66054 5.3 benzdeus November 30, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation