Description

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.9.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-02T15:17:10.040Z",
  "pubdate": "2026-10-02T15:17:10.040Z",
  "executiveSummary": "This vulnerability is classified as a Missing Authorization flaw affecting the ThimPress LearnPress plugin for WordPress.\nThe vulnerability exists due to improperly configured access control security levels, which fail to adequately validate user permissions during specific requests.\nThe issue affects all versions of LearnPress from n/a through 4.4.9.1.\nThis security defect allows remote, unauthenticated or low-privileged attackers to perform unauthorized actions that should be restricted to users with higher administrative or instructor privileges.\nThe risk implication is significant as it facilitates unauthorized data manipulation or unauthorized access to sensitive administrative functions within the Learning Management System (LMS) environment.\nSuccessful exploitation requires the attacker to identify the specific API endpoints or functions that lack proper authorization checks and craft requests that interact with these restricted interfaces.",
  "technicalDetails": "The vulnerability resides within the access control layer of the LearnPress plugin, specifically affecting how incoming requests are validated against user roles and permissions.\nThe root cause is a failure to consistently enforce authorization checks at the controller or function level, allowing requests to proceed to execution without ensuring the requester possesses the required capability or administrative status.\nUnder normal operating conditions, sensitive functions within the plugin should implement strict permission checks (e.g., using WordPress functions like current_user_can() or internal plugin-specific capability checks) before executing core logic. In the affected versions, these checks are either missing, incorrectly bypassed, or misconfigured.\nThe exploitation flow typically begins with an attacker identifying exposed endpoints or internal functions that perform sensitive operations, such as course management, user enrollment modifications, or setting configurations. By crafting a specific HTTP request targeting these vulnerable functions, an attacker can bypass the intended security constraints.\nBecause the access control logic is flawed, the application erroneously processes the request as if the caller had sufficient privileges. This leads to the unauthorized invocation of backend functions.\nThe vulnerability does not necessarily require high-level authentication. Depending on the specific function exposed, an unauthenticated user or an authenticated student might be able to trigger actions reserved for course instructors or site administrators.\nPost-exploitation, the impact can be severe depending on the function targeted. For instance, an attacker could potentially modify course content, alter student progress, change enrollment statuses, or manipulate plugin settings, which could lead to a compromise of the overall integrity of the LMS platform.\nThe flaw affects all versions within the specified range (n/a through 4.4.9.1), indicating that the improper access control configuration is systemic across these versions rather than limited to a single sub-module. The vulnerability is network-accessible, as these endpoints are typically exposed via the standard web interface of the WordPress installation."
}