Is CVE-2026-11988 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11988 being exploited in the wild.

How severe is CVE-2026-11988?

Medium severity, with a CVSS score of 6.5, published 1 July 2026.

Which products and versions are affected?

ThimPress LearnPress up to, and including, 4.3.9.1.

Is there a fix for CVE-2026-11988?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11988 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11988?

Check whether you run ThimPress LearnPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11988: ThimPress LearnPress IDOR in userId parameter

CVE-2026-11988 · Severity: medium · CVSS 6.5 · Published 2026-07-01

LearnPress, a popular WordPress plugin for creating and selling online courses, contains a security flaw that allows logged-in users to view private course data. Specifically, an attacker with a basic student account can access the enrollment progress and completion records of instructors and administrators. This could lead to the exposure of sensitive educational data and administrative activity tracking.

Technologies: ThimPress LearnPress. Vendors: ThimPress.

Quick answers

Is CVE-2026-11988 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11988 being exploited in the wild.
How severe is CVE-2026-11988?: Medium severity, with a CVSS score of 6.5, published 1 July 2026.
Which products and versions are affected?: ThimPress LearnPress up to, and including, 4.3.9.1.
Is there a fix for CVE-2026-11988?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11988 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11988?: Check whether you run ThimPress LearnPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The LearnPress plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 4.3.9.1. The vulnerability exists within the 'userId' parameter due to missing validation on a user-controlled key in the REST API lazy load controller. An authenticated attacker with subscriber-level permissions can exploit this to view course enrollment progress and completion data of users with 'LP_TEACHER_ROLE' or administrator roles. While the plugin correctly blocks access between regular subscribers, it fails to validate requests targeting higher-privileged accounts. The issue is addressed in version 4.4.0.

Affected products

ThimPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses up to, and including, 4.3.9.1

Timeline

2026-07-01: advisory: NVD publication date
2026-07-01: disclosed: Wordfence disclosure date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.