What the vulnerability does
01Description
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to payment bypass through user-controlled key in all versions up to, and including, 4.3.5. This is due to improper handling of user-supplied request parameters in the REST API endpoint, which passes the unsanitized parameter array to the add_to_cart() function where array_merge() allows attacker-controlled values to overwrite hardcoded defaults. This makes it possible for authenticated attackers, with subscriber-level access and above, to enroll in any paid course entirely free of charge by supplying a quantity value of zero, which causes the order total to calculate as $0 and bypasses all payment gateway requirements.
Explanation of Vulnerability in Simple Terms
02Summary
LearnPress versions up to 4.3.5 contain an authorization flaw that allows authenticated users to modify data they should not have access to. The vulnerability requires a valid WordPress account but no special privileges. An attacker with low-level access can alter course or lesson content, affecting site integrity. Update to a version newer than 4.3.5.
What an attacker can do
03Attacker Capabilities
Modify course or lesson data without proper authorization.
Potential impact on your site
04Site Impact
Authenticated users can alter course content, potentially disrupting learning materials or student progress.
Conditions required to exploit
05Prerequisites
Valid WordPress user account with low-level privileges; network access to the site.
Key dates
06Disclosure timeline
May 14, 2026
CVE published
May 14, 2026
Record updated
