CVE-2025-11368mediumobserved exploitationCWE-200

CVE-2025-11368: medium-severity vulnerability in thimpress LearnPress – WordPress LMS Plugin…

LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure

Published · Updated

Follow this CVE+ Monitor LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 5.3epss 1.0%
from disclosure to weapon
Published on NVDNov 21
VulnCheck+130d
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
thimpress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Related CVEs — thimpress LearnPress – WordPress LMS Plugin…

In the same product, most dangerous first.

CVE-2024-8522CRITICALLearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'EPSS 62.9%CVE-2023-6567CRITICALLearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_byEPSS 51.4%CVE-2024-4434CRITICALLearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL InjectionEPSS 36.9%CVE-2024-8529CRITICALLearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'EPSS 12.1%CVE-2023-6634HIGHLearnPress <= 4.2.5.7 - Command InjectionEPSS 8.6%CVE-2026-104736CRITICALLearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' ParameterEPSS 2.5%