CVE-2022-47615

CVE-2022-47615 LearnPress Plugin 4.2.0 - Unauthenticated LFI Description Description The plugin does not validate various parameters in the lp/v1/courses/archive-course REST endpoints before using them in include statement, which could lead to LFI issues. How to use root@kitploit: $ python3...

CVE-2024-8529

CVE-2024-8529 LearnPress – WordPress LMS Plugin = 4.2.7 - Inyección SQL no autenticada a través de 'cfields' Descripción El plugin LearnPress – WordPress LMS Plugin para WordPress es vulnerable a inyección SQL a través del parámetro 'cfields' del endpoint /wp-json/lp/v1/courses/archive-course de ...

CVE-2022-45808

CVE-2022-45808 LearnPress Plugin 4.2.0 - Unauthenticated time-based blind SQLi Description The plugin does not properly sanitise and escape the order by parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users POC root@kitploit: $ python...

PT-2026-93303

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...

PT-2026-87026

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout custom css' parameter in all versions up to, and including, 4.3.9.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-82023

LearnPress WordPress Plugin versions before 4.4.6 are affected by a broken object-level authorization (BOLA) vulnerability in the question answer insert code path. The root cause is a missing ownership check that fails to verify whether the question belongs to the authenticated user. An attacker ...

PT-2026-85208

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary...

WordPress LearnPress plugin < 4.0.3 - Unauthenticated Order Status Disclosure vulnerability

Unauthenticated Order Status Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin LearnPress & Sepay Payment versions 4.0.3...

EUVD-2026-55024

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

CVE-2026-12971

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

📄 WordPress LearnPress 4.3.2.8 Unauthenticated Quiz Answer Deletion

WordPress LearnPress plugin version 4.3.2.8 contains an unauthenticated quiz answer deletion vulnerability through a broken access control. A remote attacker can delete quiz answers without authorization. This proof of concept exploit demonstrates the vulnerable request flow against the affected...

📄 WordPress LearnPress 4.2.6.8.1 LFI / Remote Code Execution

WordPress LearnPress plugin version 4.2.6.8.1 contains an authenticated Contributor+ local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

CVE-2026-12970

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link...

CVE-2026-12970

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link...

CVE-2026-13765 LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the checkanswer. This makes it possible for unauthenticated attackers to extract the correct-answer markers...

CVE-2026-13765

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the checkanswer. This makes it possible for unauthenticated attackers to extract the correct-answer markers...

PT-2026-60707

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check answer. This makes it possible for unauthenticated attackers to extract the correct-answer marker...

CVE-2026-12732

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'classwrapperform' shortcode attribute in versions up to, and including, 4.4.0. This is due to insufficient input sanitization and output escaping in the FilterCourseTemplate::sections method at line 98, wher...

EUVD-2026-40934

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'classwrapperform' shortcode attribute in versions up to, and including, 4.4.0. This is due to insufficient input sanitization and output escaping in the FilterCourseTemplate::sections method at line 98, wher...

CVE-2026-12732

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'classwrapperform' shortcode attribute in versions up to, and including, 4.4.0. This is due to insufficient input sanitization and output escaping in the FilterCourseTemplate::sections method at line 98, wher...