LearnPress lets Editors modify arbitrary WordPress options
LearnPress through 4.4.4 lets an Editor or higher call the learnpress_create_page AJAX action. LP_Admin_Ajax::create_page() accepts attacker-controlled field_name as an option key and LP_Helper::create_page() passes it to update_option(), allowing a positive page ID to replace arbitrary site-wide settings, including users_can_register or active_plugins.
- Component
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Plugin slug
learnpress- Affected
- <= 4.4.4
- Safe version
- See mitigation notes
- Published
- Aug 25, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Aug 25, 2026 and is one of 81 known issues for this plugin.
Update, patch or deactivate.
A newer 4.4.5 release is available and its official changelog mentions security fixes, but it does not specifically identify this CVE. Update to the latest release, audit site options and Editor activity, and restore altered settings from a known-good record. The official upstream changelog lists version 4.4.5, which is newer than the published affected range. Its changelog does not clearly confirm this specific fix, so it is not counted as a known-safe release.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N