CVE-2026-11988: LearnPress IDOR Vulnerability in WordPress LMS Plugin

Technical summary

CVE-2026-11988 is an Insecure Direct Object Reference (IDOR) vulnerability in LearnPress affecting all versions through 4.3.9.1. The 'userId' parameter lacks validation when processing enrollment and completion data requests, allowing authenticated users to enumerate and access sensitive course progress records. The authorization logic fails to enforce role-based restrictions on cross-user data access for accounts holding LP_TEACHER_ROLE or administrator privileges. The vulnerability is rooted in CWE-639 (Authorization through User-Controlled Key) and is network-accessible with low attack complexity, requiring only valid user credentials.

Business impact

Organizations running WordPress LMS platforms using LearnPress may face confidentiality breaches exposing instructor and administrator course progress metrics. This could reveal sensitive learning patterns, performance trends, or completion rates of staff accounts. While the attack surface is limited to authenticated users, a compromised low-privilege account (via phishing, credential reuse, or brute force) becomes a pivot point to surveil educational leadership activity and course performance data. The lack of CISA KEV tracking suggests this has not yet been observed in active exploitation campaigns.

Affected systems

The LearnPress plugin for WordPress is affected in all versions up to and including 4.3.9.1. Vulnerable installations are those running LearnPress without a patched release. Sites using this plugin with multiple user roles (instructors and administrators) face the highest risk. Exposure is limited to WordPress multisite and single-site deployments where the plugin is active and users have subscriber-level or higher permissions.

Exploitability

Exploitation requires valid WordPress user credentials (subscriber level minimum) and knowledge of target user IDs. The attack is straightforward: an authenticated attacker simply modifies the 'userId' parameter in requests to enumerate instructor and administrator course data. No user interaction or social engineering is needed beyond initial account compromise. The CVSS score of 6.5 (Medium) reflects the authentication requirement and confidentiality-only impact, though the practical risk is elevated in environments with weak password policies or credential compromise vectors.

Remediation

Update the LearnPress plugin to a patched version released after 4.3.9.1. Verify against the official LearnPress vendor advisory for the exact patch version number. No configuration changes mitigate this vulnerability; code-level fixes are required. Administrators should enforce strong password policies to reduce the likelihood of authenticated account compromise and consider role-based access restrictions at the application level pending patching.

Patch guidance

Consult the official LearnPress plugin repository and vendor security advisories to identify the minimum patched version addressing CVE-2026-11988. Update through the WordPress plugin dashboard or via command-line tools. Prior to patching, audit user account creation and access logs to identify any potential unauthorized data access. Test patches in a non-production environment first to ensure compatibility with custom course configurations and student enrollment workflows.

Detection guidance

Monitor WordPress access logs for repeated or suspicious requests to user profile, course enrollment, or course completion endpoints with varying 'userId' parameter values from the same source IP or user account. Review web application firewall (WAF) logs for parameter tampering patterns. Check LearnPress database logs (if available) for cross-user data queries initiated by low-privilege accounts. Implement logging on the 'userId' parameter handling to track unauthorized access attempts. Query WordPress user meta and course progress tables for evidence of unauthorized access by comparing access timestamps against user login records.

Why prioritize this

This vulnerability merits urgent attention for any organization using LearnPress with instructor or administrator accounts. The barrier to exploitation—valid login credentials—is lower than exploits requiring zero-day access, and credential compromise is common in WordPress environments. The confidentiality breach of instructor performance data could have compliance implications under privacy regulations. However, the Medium severity and lack of current KEV tracking indicate this is not yet an actively exploited threat in the wild. Prioritize patching based on the sensitivity of course data and the privilege distribution on your site.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) is driven by four factors: (1) Network-accessible attack vector requiring no special network capabilities, (2) Low attack complexity with no special conditions needed, (3) Low privilege requirement (subscriber level), (4) High confidentiality impact via exposure of course progress and enrollment data, and (5) No integrity or availability impact. The score is not elevated to High due to the authentication prerequisite. Real-world risk is context-dependent: organizations with weak account security or high-value course data should treat this as high-priority despite the Medium CVSS rating.

Frequently asked questions