Description

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-05T12:16:46.923Z",
  "pubdate": "2026-09-05T12:16:46.923Z",
  "executiveSummary": "The LearnDash LMS plugin for WordPress is susceptible to an authorization bypass vulnerability affecting versions 4.25.0 through 5.1.6. This security flaw stems from an improper implementation of access control mechanisms within the plugin's enrollment logic. By failing to validate the authorization status of the requester, the plugin allows unauthenticated actors to enroll arbitrary user accounts into paid educational content without completing the required payment verification processes.\nThe vulnerability carries significant business risk, as it effectively nullifies the plugin's monetization framework, enabling unauthorized access to premium intellectual property and potentially leading to revenue loss. The exploitation process requires no elevated privileges, allowing any external actor to interact with the vulnerable enrollment endpoint. Given that the flaw resides within the core functionality of the LMS, it presents a critical threat to the integrity of site enrollment data and the protection of protected digital assets. Organizations utilizing affected versions are encouraged to monitor for unauthorized enrollment activity and restrict access to the affected components until remediation can be applied.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient server-side validation of user authorization and payment verification tokens during the course enrollment sequence. Specifically, the affected versions of LearnDash LMS fail to perform a definitive check on the caller's identity or the legitimacy of the transaction metadata before processing course access privileges.\nIn a secure implementation, an enrollment request should trigger a workflow that validates the user's session against their assigned permissions, verifies the existence of a valid payment transaction ID, and confirms the status of the transaction via an integrated payment gateway. In the vulnerable versions, the functional logic controlling the enrollment process lacks these mandatory verification steps. Consequently, an attacker can craft a direct HTTP request to the vulnerable endpoint, substituting the target user's identifier—such as a user ID or email address—within the request parameters to force an enrollment.\nThe attack flow proceeds as follows: First, the attacker identifies the internal endpoint responsible for handling course enrollment requests within the WordPress environment. Second, the attacker executes a crafted request, bypassing the client-side UI and the payment gateway integration. Because the backend code fails to perform adequate server-side authorization checks, the request is treated as a valid administrative or legitimate user-driven enrollment action. Finally, the plugin updates the database to associate the targeted user account with the premium course, thereby granting full access to the educational materials without the system ever having requested or received payment confirmation.\nThis vulnerability is classified as an improper authorization bypass, as the software performs the requested action without verifying that the requester has the authority to perform such an operation. Because this occurs at the API or endpoint level, it is accessible via standard network protocols, specifically over HTTP/HTTPS, and does not require the attacker to possess an authenticated session or elevated privileges. The impact of this exploit is severe, as it facilitates unauthorized access to private content and bypasses the financial enforcement mechanisms built into the LearnDash LMS plugin. Post-exploitation, the malicious actor successfully creates a persistent state where the target user retains access to the enrolled content, necessitating manual database-level intervention to remediate the illegitimate enrollments."
}