LearnPress vulnerability: is your WooCommerce store affected?

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

1. Missing permission check

   An action that should need permission could be done without it.

   Score 7.5 (high)no login neededAffected: older than 4.4.12Fixed in 4.4.12Published 26 October 2026CVE-2026-115599

   Advisory: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

2. PHP object injection

   In some setups, someone could make your server run code.

   Score 9.8 (critical)no login neededAffected: older than 4.4.11Fixed in 4.4.11Published 16 October 2026CVE-2026-104736

   Advisory: The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the...

3. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.2 (high)no login neededAffected: older than 4.4.11Fixed in 4.4.11Published 16 October 2026CVE-2026-109208

   Advisory: The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all...

4. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.1 (high)no login neededAffected: older than 4.4.9.1Fixed in 4.4.9.1Published 5 October 2026CVE-2026-104670

   Advisory: Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

5. Missing permission check

   An action that should need permission could be done without it.

   Score 7.5 (high)no login neededAffected: older than 4.4.9Fixed in 4.4.9Published 15 September 2026CVE-2026-93882

   Advisory: The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the...

6. Data exposure

   Information meant to stay private could be read.

   Score 7.5 (high)no login neededAffected: older than 4.4.2Fixed in 4.4.2Published 30 June 2026CVE-2026-13765

   Advisory: The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer.

7. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.1 (high)no login neededAffected: older than 4.3.7Fixed in 4.3.7Published 1 June 2026CVE-2026-48865

   Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress allows Reflected XSS. This issue affects LearnPress: from n/a through 4.3.6.

8. Missing permission check

   An action that should need permission could be done without it.

   Score 7.5 (high)no login neededAffected: older than 4.3.0Fixed in 4.3.0Published 30 November 2025CVE-2025-66054

   Advisory: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through <= 4.2.9.4.

9. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 7.5 (high)no login neededAffected: older than 4.2.7.1Fixed in 4.2.7.1Published 11 September 2024CVE-2024-8522

   Advisory: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and...

10. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 7.5 (high)no login neededAffected: older than 4.2.7.1Fixed in 4.2.7.1Published 11 September 2024CVE-2024-8529

    Advisory: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up to, and...

11. Cross-site request forgery

    Someone could trick a logged-in admin into making a change.

    Score 8.8 (high)no login neededAffected: older than 4.2.6.9Fixed in 4.2.6.9Published 1 August 2024CVE-2024-39641

    Advisory: Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2.

12. File inclusion

    Someone could make the plugin load files it shouldn't, which can expose data or run code.

    Score 8.8 (high)needs only a customer accountAffected: older than 4.2.6.9Fixed in 4.2.6.9Published 24 July 2024CVE-2024-6589

    Advisory: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'render_content_block_template' function.

13. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 9.8 (critical)no login neededAffected: older than 4.2.6.6Fixed in 4.2.6.6Published 9 May 2024CVE-2024-4434

    Advisory: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user...

14. File upload

    Someone could upload files to your server, which can include code.

    Score 8.8 (high)needs only a customer accountAffected: older than 4.2.6.6Fixed in 4.2.6.6Published 9 May 2024CVE-2024-4397

    Advisory: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and including, 4.2.6.5.

15. Cross-site request forgery

    Someone could trick a logged-in admin into making a change.

    Score 8.8 (high)no login neededAffected: older than 4.0.1Fixed in 4.0.1Published 4 April 2024CVE-2024-2115

    Advisory: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0.

16. Code execution

    Someone could run their own code on your server.

    Score 9.8 (critical)no login neededAffected: older than 4.2.5.8Fixed in 4.2.5.8Published 3 January 2024CVE-2023-6634

    Advisory: The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function.

17. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 7.5 (high)no login neededAffected: older than 4.2.5.8Fixed in 4.2.5.8Published 2 January 2024CVE-2023-6567

    Advisory: The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and...

18. Missing permission check

    An action that should need permission could be done without it.

    Score 7.6 (high)needs only a customer accountAffected: older than 4.2.3.1Fixed in 4.2.3.1Published 4 July 2023CVE-2023-36516

    Advisory: Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.

19. Missing permission check

    An action that should need permission could be done without it.

    Score 7.3 (high)no login neededAffected: older than 4.2.3.1Fixed in 4.2.3.1Published 4 July 2023CVE-2023-36515

    Advisory: Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.

20. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 9.9 (critical)no login neededAffected: older than 4.2.0Fixed in 4.2.0Published 20 January 2023CVE-2022-45808

    Advisory: SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.

21. File inclusion

    Someone could make the plugin load files it shouldn't, which can expose data or run code.

    Score 9.3 (critical)no login neededAffected: older than 4.2.0Fixed in 4.2.0Published 20 January 2023CVE-2022-47615

    Advisory: Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.

5 older holes, published before 1 January 2023

1. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 9.1 (critical)needs only a customer accountAffected: older than 4.2.0Fixed in 4.2.0Published 20 December 2022CVE-2022-45820

   Advisory: SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.

2. Code execution

   Someone could run their own code on your server.

   Score 8.1 (high)no login neededAffected: older than 4.1.7.2Fixed in 4.1.7.2Published 3 October 2022CVE-2022-3360

   Advisory: The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to...

3. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 9.8 (critical)no login neededAffected: older than 4.1.5Fixed in 4.1.5Published 9 November 2021CVE-2021-24951

   Advisory: The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues

4. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 8.8 (high)needs only a customer accountAffected: older than 3.2.6.8Fixed in 3.2.6.8Published 29 April 2020CVE-2020-6010

   Advisory: LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection

5. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 8.1 (high)no login neededAffected: older than 3.2.6.9Fixed in 3.2.6.9Published 20 April 2020CVE-2020-11511

   Advisory: The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter.

How to check your version

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Find LearnPress. The version number is under its name. If it is lower than 4.4.12, your store is affected.
3. No login to hand? Open https://yourstore.com/wp-content/plugins/learnpress/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
2. On the copy, update LearnPress to 4.4.12 or newer: Dashboard > Updates, or Update now on the Plugins page.
3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use LearnPress.
5. If everything works, make the same update on the live store and place one more test order.
6. If you no longer use LearnPress, delete it instead of leaving it deactivated.

Questions

Which LearnPress version fixes it?

Version 4.4.12 or newer fixes all 26 issues on this page.

How do I know if my store is affected?

Your store is affected if it runs LearnPress older than 4.4.12. In WordPress, open Plugins and read the version under LearnPress. Without logging in, open yourstore.com/wp-content/plugins/learnpress/readme.txt and read the Stable tag line.

I don't use LearnPress any more. Is a deactivated copy safe?

Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.

Can someone fix it for me?

Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 5 November 2026.