PT-2025-42695 · WordPress · Learnpress+1

Lucas Montes · Published 2025-10-18 · Updated 2025-10-18 · CVE-2025-11372

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin versions up to and including 4.2.9.2

Description The LearnPress – WordPress LMS Plugin is susceptible to data modification due to absent capability checks on Admin Tools REST endpoints. These endpoints are registered with return true as the permission callback, allowing unauthenticated attackers to perform destructive database operations. Specifically, attackers can drop indexes on any table, including WordPress core tables like wp options, create duplicate configuration entries, and degrade site performance. This is achievable through the /wp-json/lp/v1/admin/tools/create-indexs endpoint by providing table names.

Recommendations Update to version 4.2.9.4 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11372

Affected Products

Learnpress

Wordpress

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-11372 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11372 · Vendor Advisory
• https://github.com/LearnPress/learnpress/commit/cf940a437539a803e49136bdff7a53e1f2b2ca44 · Note
• https://t.me/CVEtracker/35264 · Telegram Post
• https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L30 · Note
• https://twitter.com/VulmonFeeds/status/1979471320514486677 · Twitter Post
• https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L101 · Note
• https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Databases/class-lp-db.php#L316 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d2365e92-d70d-47fa-9abe-7cbdd6336f39?source=cve · Note
• https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L145 · Note
• https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Databases/class-lp-db.php#L291 · Note
• https://twitter.com/VolerionSec/status/1979448939762860252 · Twitter Post
• https://t.me/cveNotify/139328 · Telegram Post