LearnPress <= 4.3.6 — Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under LearnPress – WordPress LMS Plugin for Create and Sell Online Courses.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 4.3.7, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Jamshed Yergashvoyev (CVE Guy).

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the 'return_type' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the plaintext post_password of password-protected courses and the full post_content, post_author, and post_name of unpublished draft, private, and pending courses via the unrestricted SELECT * fallback query. Exploitation requires supplying both c_status=all (to bypass the publish-only post_status WHERE clause) and return_type=json (to prevent the safe DISTINCT(ID) AS ID field override) in a single unauthenticated request to the /wp-json/lp/v1/courses/archive-course endpoint.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Jun 5, 2026

   CVE published

   Severity medium, CVSS 5.3

2. Nov 13, 2026

   Record last updated