PT-2026-40851 · WordPress · Learnpress
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.3.6
Description
Improper handling of user-supplied request parameters in the REST API endpoint allows authenticated attackers with subscriber-level access and above to bypass payment requirements. The issue occurs because an unsanitized parameter array is passed to the
add to cart() function, where array merge() enables attacker-controlled values to overwrite hardcoded defaults. By supplying a quantity value of zero, an attacker can cause the order total to be calculated as $0, allowing them to enroll in paid courses for free.Recommendations
Update to a version later than 4.3.5.
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Learnpress