PT-2026-47134 · WordPress · Learnpress
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.3.7
Description
An issue exists that allows unauthenticated attackers to extract sensitive data through an unrestricted SELECT * fallback query. By sending a request to the '/wp-json/lp/v1/courses/archive-course' endpoint with the
c status parameter set to 'all' and the return type parameter set to 'json', attackers can bypass the publish-only post status filter and prevent the safe ID field override. This exposure includes the plaintext post password of password-protected courses, as well as the post content, post author, and post name of unpublished draft, private, and pending courses.Recommendations
Update the plugin to a version later than 4.3.6.
Avoid using the
return type parameter in the '/wp-json/lp/v1/courses/archive-course' endpoint until the update is applied.Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Learnpress