CVE-2026-93882

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::render_material_items() callback exposed on the public lp-ajax-handle (load_content_via_ajax) endpoint. The endpoint is explicitly listed in the AbstractAjax no-nonce allowlist and performs no capability check, and the render_material_items() handler decides authorization against one attacker-supplied identifier (course_id) while fetching the returned material rows via a second, independently attacker-supplied identifier (item_id) with no check that the lesson belongs to the authorized course. This makes it possible for unauthenticated attackers to read and download course-material files (uploaded and external file paths/URLs) belonging to lessons in paid or enrollment-required courses, provided any single course on the site has 'No Required Enroll' enabled and owns at least one material file.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/Ajax/AbstractAjax.php#L31
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/Ajax/LoadContentViaAjax.php#L25
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/Databases/class-lp-material-db.php#L92
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/TemplateHooks/Course/CourseMaterialTemplate.php#L113
https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/TemplateHooks/Course/CourseMaterialTemplate.php#L143
https://www.wordfence.com/threat-intel/vulnerabilities/id/1f35f646-1bd6-4785-bdc2-c815644b2b2d?source=cve

Configurations

No configuration.

History

01 Oct 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-01 08:16

Updated : 2026-10-03 16:16

NVD link : CVE-2026-93882

Mitre link : CVE-2026-93882

CVE.ORG link : CVE-2026-93882

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-93882", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93882", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-03T15:35:30.930620Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "thimpress", "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.4.8"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-01T08:16:53.330", "references": [{"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/Ajax/AbstractAjax.php#L31", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/Ajax/LoadContentViaAjax.php#L25", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/Databases/class-lp-material-db.php#L92", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/TemplateHooks/Course/CourseMaterialTemplate.php#L113", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/TemplateHooks/Course/CourseMaterialTemplate.php#L143", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f35f646-1bd6-4785-bdc2-c815644b2b2d?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::render_material_items() callback exposed on the public lp-ajax-handle (load_content_via_ajax) endpoint. The endpoint is explicitly listed in the AbstractAjax no-nonce allowlist and performs no capability check, and the render_material_items() handler decides authorization against one attacker-supplied identifier (course_id) while fetching the returned material rows via a second, independently attacker-supplied identifier (item_id) with no check that the lesson belongs to the authorized course. This makes it possible for unauthenticated attackers to read and download course-material files (uploaded and external file paths/URLs) belonging to lessons in paid or enrollment-required courses, provided any single course on the site has 'No Required Enroll' enabled and owns at least one material file."}], "lastModified": "2026-10-03T16:16:44.493", "sourceIdentifier": "security@wordfence.com"}