Executive brief
LearnPress is a WordPress plugin for creating and managing online courses. The plugin fails to verify that users are authorized before allowing them to download previously generated order export files. An attacker who can guess or obtain a file identifier can download sensitive customer information including names, email addresses, and purchase history without logging in.
Technical details
The vulnerability is an authentication bypass and sensitive data exposure flaw (CWE-200) in the lp_download_order functionality. The plugin does not perform authentication, capability, or nonce checks before serving order export files, allowing unauthenticated attackers to download files if they can determine the file identifier. The attack is network-accessible and requires no authentication or special privileges, only the ability to guess or enumerate export file identifiers. An attacker can retrieve customer names, purchase details, amounts, and guest email addresses. The vulnerability is fixed in version 4.4.7.
Affected products
- LearnPress LearnPress before 4.4.7
Timeline
- 2026-09-14: disclosed
- 2026-09-16: patched: Fixed in version 4.4.7