CVE-2026-11988
Received Received - Intake

Insecure Direct Object Reference in LearnPress WordPress LMS Plugin

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: Wordfence

Description
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.9.1 via the 'userId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the course enrollment progress and completion data belonging to any instructor or administrator account on the site. This IDOR does not apply when the target user is a regular subscriber, as the guard correctly blocks cross-subscriber access; exploitation is limited to cases where the victim user holds the LP_TEACHER_ROLE or administrator role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-01
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2026-11988
EUVD
EUVD-2026-40906

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thimpress learnpress to 4.3.9.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The LearnPress WordPress LMS Plugin is vulnerable to an Insecure Direct Object Reference (IDOR) issue in all versions up to and including 4.3.9.1. This vulnerability arises because the plugin fails to properly validate the 'userId' parameter, which is controlled by the user.

As a result, authenticated attackers with subscriber-level access or higher can exploit this flaw to view course enrollment progress and completion data of any instructor or administrator account on the site.

However, this vulnerability does not allow access to data of regular subscribers, as the plugin correctly blocks cross-subscriber access. The exploitation is limited to cases where the targeted user has the LP_TEACHER_ROLE or administrator role.

Impact Analysis

This vulnerability can impact you by allowing unauthorized users with low-level access (subscriber or above) to view sensitive course progress and completion data of instructors or administrators.

Such unauthorized disclosure of data can lead to privacy breaches and potential misuse of instructor or administrator information.

Since the vulnerability does not affect regular subscriber data, the impact is specifically on higher privileged users' course-related information.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11988. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart