CVE-2025-11372mediumobserved exploitationCWE-862

CVE-2025-11372: medium-severity vulnerability in thimpress LearnPress – WordPress LMS Plugin…

LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation

Published · Updated

Follow this CVE+ Monitor LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

35Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendcvss 6.5epss 0.5%
from disclosure to weapon
Published on NVDOct 18
VulnCheckOct 18
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin Tools REST endpoints which are registered with permission_callback set to __return_true. This makes it possible for unauthenticated attackers to perform destructive database operations including dropping indexes on any table (including WordPress core tables like wp_options), creating duplicate configuration entries, and degrading site performance via the /wp-json/lp/v1/admin/tools/create-indexs endpoint granted they can provide table names.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
thimpress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Related CVEs — thimpress LearnPress – WordPress LMS Plugin…

In the same product, most dangerous first.

CVE-2024-8522CRITICALLearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'EPSS 62.9%CVE-2023-6567CRITICALLearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_byEPSS 51.4%CVE-2024-4434CRITICALLearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL InjectionEPSS 36.9%CVE-2024-8529CRITICALLearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'EPSS 12.1%CVE-2023-6634HIGHLearnPress <= 4.2.5.7 - Command InjectionEPSS 8.5%CVE-2026-104736CRITICALLearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' ParameterEPSS 2.5%