CVE-2025-13956
Unauthorized Data Access in LearnPress Plugin via Missing Capability Check
Publication date: 2025-12-16
Last updated on: 2025-12-16
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpres | learnpress | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the LearnPress WordPress LMS Plugin up to version 4.3.1, where the REST API endpoint for order statistics ('statistic' route) lacks proper permission checks. Specifically, the permission callback for this endpoint always returns true, allowing unauthenticated users to access order statistics data such as total revenue summaries and order status counts without any authentication or authorization. [1]
How can this vulnerability impact me? :
An unauthenticated attacker can exploit this vulnerability to view sensitive order statistics data from the LearnPress plugin, including total revenue summaries and order status counts. This unauthorized data exposure could lead to information disclosure that might be used for malicious purposes such as competitive intelligence or targeted attacks. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the LearnPress plugin's REST API endpoint for order statistics is accessible without authentication. Specifically, test the HTTP GET request to the endpoint `/wp-json/lp/v1/orders/statistic` on your WordPress site. If this endpoint returns order statistics data without requiring authentication, your system is vulnerable. A sample command using curl would be: `curl -X GET https://your-wordpress-site.com/wp-json/lp/v1/orders/statistic` [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable REST API endpoint by implementing authentication or permission checks, such as requiring logged-in users with appropriate capabilities to access the `statistic` route. Alternatively, temporarily disabling or removing the LearnPress plugin until an updated version with the fix is released can prevent unauthorized data access. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to access order statistics data, including total revenue summaries and order status counts, which could lead to unauthorized disclosure of potentially sensitive business information. This unauthorized data exposure may impact compliance with data protection regulations such as GDPR or HIPAA if the exposed data includes personal or sensitive information. However, the provided resources do not explicitly discuss compliance implications or whether personal data is involved. [1]