# CVE-2026-7648: LearnPress WordPress Plugin payment bypass in REST API

Source: https://junglewise.ai/threats/cve-2026-7648-learnpress-wordpress-plugin-payment-bypass-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-7648 · Severity: medium · CVSS 4.3 · Published 2026-05-14

LearnPress is a popular WordPress plugin used to create and sell online courses. A security flaw allows registered users to bypass the payment process and enroll in any paid course for free. By manipulating the course quantity during the checkout process, an attacker can force the total price to zero, resulting in a loss of revenue and unauthorized access to premium content.

Technologies: [ThimPress LearnPress](https://junglewise.ai/threats/technologies/learnpress). Vendors: [ThimPress](https://junglewise.ai/threats/vendors/thimpress).

## Quick answers

**Is CVE-2026-7648 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7648 being exploited in the wild.

**How severe is CVE-2026-7648?** Medium severity, with a CVSS score of 4.3, published 14 May 2026.

**Which products and versions are affected?** ThimPress LearnPress Up to and including 4.3.5.

**Is there a fix for CVE-2026-7648?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7648 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7648?** Check whether you run ThimPress LearnPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The LearnPress plugin (up to version 4.3.5) is vulnerable to an authorization bypass (CWE-639) due to improper handling of user-supplied parameters in its REST API endpoint. Specifically, the REST API passes unsanitized input to the add_to_cart() function, where an array_merge() call allows user-controlled values to overwrite hardcoded defaults. An authenticated attacker with subscriber-level permissions can exploit this by submitting a quantity value of zero. This causes the internal order calculation to result in a $0 total, effectively bypassing payment gateway requirements and granting free access to paid courses.

## Affected products

- LearnPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses Up to and including 4.3.5

## Timeline

- 2026-05-14: disclosed: CVE published by Wordfence/NVD

## References

- [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.3/inc/cart/class-lp-cart.php](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.3/inc/cart/class-lp-cart.php)
- [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.3/inc/cart/class-lp-cart.php](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.3/inc/cart/class-lp-cart.php)
- [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.3/inc/rest-api/v1/frontend/class-lp-rest-courses-controller.php](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.3/inc/rest-api/v1/frontend/class-lp-rest-courses-controller.php)
- [https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/cart/class-lp-cart.php](https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/cart/class-lp-cart.php)
- [https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/cart/class-lp-cart.php](https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/cart/class-lp-cart.php)
- [https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/frontend/class-lp-rest-courses-controller.php](https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/frontend/class-lp-rest-courses-controller.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3521636%40learnpress&new=3521636%40learnpress&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3521636%40learnpress&new=3521636%40learnpress&sfp_email=&sfph_mail=)

## Related threats

- [ThimPress LearnPress broken access control in version 4.4.12](https://junglewise.ai/threats/cve-2026-52713-missing-authorization-vulnerability-in-thimpress-learnpress)
- [LearnPress broken access control for subscribers](https://junglewise.ai/threats/cve-2026-42690-subscriber-broken-access-control-in-learnpress-4-4-10-versions)
- [ThimPress LearnPress broken access control vulnerability](https://junglewise.ai/threats/cve-2026-115599-missing-authorization-vulnerability-in-thimpress-learnpress)
- [ThimPress LearnPress broken access control](https://junglewise.ai/threats/cve-2026-115598-missing-authorization-vulnerability-in-thimpress-learnpress)
- [ThimPress LearnPress broken access control in pages](https://junglewise.ai/threats/cve-2026-115597-missing-authorization-vulnerability-in-thimpress-learnpress)