Executive brief
LearnPress is a WordPress plugin for creating online learning courses. The plugin fails to validate user input in an administrative AJAX action, allowing Editor-level users to modify any WordPress configuration option—such as enabling public user registration or disabling security features—that should only be controlled by site administrators. This could lead to unauthorized site configuration changes and potential compromise of site security settings.
Technical details
The vulnerability is an improper input validation flaw in the LP_Admin_Ajax::create_page() handler, invoked via the learnpress_create_page AJAX action. While the handler checks for edit_pages capability and a valid wp_rest nonce (both available to Editors), it fails to validate the field_name parameter against a whitelist of allowed LearnPress options before passing it directly to update_option(). An authenticated Editor can supply arbitrary option names and update them to integer values representing page IDs. This allows unauthorized modification of core WordPress options like users_can_register or active_plugins, actions normally restricted to administrators. Exploitation requires Editor-level or higher access and a valid nonce. A patch is expected to restrict field_name to a LearnPress-specific allow-list.
Affected products
- LearnPress LearnPress up to and including 4.4.4
Timeline
- 2026-08-25: disclosed