Junglewise Threat Intelligence

CVE-2026-11988: ThimPress LearnPress IDOR in userId parameter

CVE-2026-11988 · Severity: medium · CVSS 6.5 · Published 2026-07-01

Technologies: ThimPress LearnPress. Vendors: ThimPress.

Executive brief

LearnPress, a popular WordPress plugin for creating and selling online courses, contains a security flaw that allows logged-in users to view private course data. Specifically, an attacker with a basic student account can access the enrollment progress and completion records of instructors and administrators. This could lead to the exposure of sensitive educational data and administrative activity tracking.

Technical details

The LearnPress plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 4.3.9.1. The vulnerability exists within the 'userId' parameter due to missing validation on a user-controlled key in the REST API lazy load controller. An authenticated attacker with subscriber-level permissions can exploit this to view course enrollment progress and completion data of users with 'LP_TEACHER_ROLE' or administrator roles. While the plugin correctly blocks access between regular subscribers, it fails to validate requests targeting higher-privileged accounts. The issue is addressed in version 4.4.0.

Affected products

  • ThimPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses up to, and including, 4.3.9.1

Timeline

  • 2026-07-01: advisory: NVD publication date
  • 2026-07-01: disclosed: Wordfence disclosure date

References

Related threats