Description

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-27T06:17:29.157Z",
  "pubdate": "2026-08-27T06:17:29.157Z",
  "executiveSummary": "The LearnPress WordPress plugin, in versions up to and including 4.0.2, contains an authorization bypass vulnerability within its REST API implementation.\nThis vulnerability allows unauthenticated, remote attackers to perform unauthorized queries against the plugin's REST endpoints to retrieve sensitive payment status information for arbitrary order identifiers.\nThe vulnerability type is classified as an Improper Authorization, which stems from a lack of access control checks on specific API routes.\nThe impact of this security flaw is information disclosure, specifically exposing order status data, which may contain sensitive business intelligence or customer transaction details.\nExploitation requires no authentication or special privileges, meaning any remote attacker with network access to the target WordPress installation can enumerate order IDs to scrape information.\nRisk implications are high for e-commerce platforms using LearnPress, as the exposure of transaction states could lead to privacy breaches or facilitate further targeted attacks against the site's users.",
  "technicalDetails": "The vulnerability resides within the LearnPress REST API architecture, specifically affecting endpoints responsible for handling order retrieval and status verification.\nThe root cause of this flaw is an absence of authentication and authorization middleware or capability checks within the function handlers associated with these REST endpoints.\nWhen a request is sent to the vulnerable endpoint, the plugin fails to verify the session or user privileges, allowing the request to proceed and access server-side data that should be restricted to authenticated administrators or the specific order owner.\nAn attacker can exploit this by crafting HTTP requests targeting the identified LearnPress REST endpoints. Since the API lacks validation, an attacker can conduct an enumeration attack by iterating through numerical or predictable order identifiers.\nThe attack flow follows a sequential process: First, the attacker identifies the vulnerable API endpoint exposed by the plugin. Second, the attacker sends an unauthenticated GET request to this endpoint, systematically varying the order identifier in the request parameters. Third, the plugin processes these requests without verifying the requester's permissions and returns the corresponding payment status and associated order details to the attacker.\nBecause there is no rate limiting or authentication barrier, an attacker can automate the discovery of all orders stored within the LearnPress database via a simple script. This provides a mechanism for mass data scraping, exposing private transaction history and payment states.\nThe post-exploitation impact includes the systematic leakage of order data, which can compromise customer privacy and reveal transaction patterns. This information can be leveraged for social engineering, targeted phishing, or to assist in further reconnaissance efforts against the WordPress infrastructure.\nThe vulnerability affects all versions of LearnPress up to and including 4.0.2. It is characterized as a low-complexity attack requiring no specialized user interaction, and it is accessible over standard HTTP/HTTPS protocols."
}