WordPress plugin
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical10
- High17
- Medium76
- Low0
All LearnPress – WordPress LMS Plugin for Create and Sell Online Courses vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated PHP Object Injection via 'checkout-email' Parameter ≤4.4.10Update to 4.4.11 | CVE-2026-104736 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters ≤4.4.10Update to 4.4.11 | CVE-2026-109208 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.4.9Update to 4.4.9.1 | CVE-2026-104670 | |
| High7.5 | Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter ≤4.4.8Update to 4.4.9 | CVE-2026-93882 | |
| High7.5 | Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints ≤4.4.1Update to 4.4.2 | CVE-2026-13765 | |
| Critical9.1 | Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion ≤4.3.2.8Update to 4.3.3 | CVE-2026-4365 | |
| Critical10.0 | Unauthenticated SQL Injection via 'c_fields' ≤4.2.7Update to 4.2.7.1 | CVE-2024-8529 | |
| Critical10.0 | Unauthenticated SQL Injection via 'c_only_fields' ≤4.2.7Update to 4.2.7.1 | CVE-2024-8522 | |
| High8.8 | Authenticated (Contributor+) SQL Injection via order Parameter ≤4.2.6.9.3Update to 4.2.6.9.4 | CVE-2024-7548 | |
| High8.8 | Authenticated (Contributor+) Local File Inclusion ≤4.2.6.8.2Update to 4.2.6.9 | CVE-2024-6589 | |
| Critical9.8 | Unauthenticated Time-Based SQL Injection ≤4.2.6.5Update to 4.2.6.6 | CVE-2024-4434 | |
| High8.8 | Authenticated (Instructor+) Arbitrary File Upload ≤4.2.6.5Update to 4.2.6.6 | CVE-2024-4397 | |
| High8.8 | Cross-Site Request Forgery to Privilege Escalation ≤4.0.0Update to 4.0.1 | CVE-2024-2115 | |
| High8.1 | Command Injection ≤4.2.5.7Update to 4.2.5.8 | CVE-2023-6634 | |
| Critical9.8 | Unauthenticated SQL Injection via order_by ≤4.2.5.7Update to 4.2.5.8 | CVE-2023-6567 | |
| High7.3 | Missing Authorization to Information Exposure ≤4.2.3Update to 4.2.3.1 | CVE-2023-36515 | |
| Critical9.8 | Unauthenticated Local File Inclusion ≤4.1.7.3.2Update to 4.2.0 | CVE-2022-47615 | |
| Critical9.8 | Unauthenticated SQL Injection ≤4.1.7.3.2Update to 4.2.0 | CVE-2022-45808 | |
| High8.8 | Authenticated (Subscriber+) SQL Injection ≤4.1.7.3.2Update to 4.2.0 | CVE-2022-45820 | |
| Critical9.8 | Unauthenticated PHP Object Injection ≤4.1.7.1Update to 4.1.7.2 | CVE-2022-3360 | |
| Critical9.8 | Authenticated SQL Injection <4.1.4Update to 4.1.4 | CVE-2021-24951 | |
| High8.8 | SQL Injection ≤3.2.6.7Update to 3.2.6.8 | CVE-2020-6010 | |
| High8.8 | SQL Injection ≤3.2.7.2Update to 3.2.7.3 | — | |
| High8.1 | Privilege Escalation via accept-to-be-teacher action parameter ≤3.2.6.8Update to 3.2.6.9 | CVE-2020-11511 | |
| High7.1 | Authenticated Page Creation and Status Modification ≤3.2.6.8Update to 3.2.6.9 | CVE-2020-11510 | |
| High7.1 | Privilege Escalation ≤3.2.6.6Update to 3.2.6.8 | CVE-2020-7916 | |
| High7.2 | Authenticated SQL Injection ≤3.0.12Update to 3.1.0 | CVE-2018-16175 |
- Critical9.8Unauthenticated PHP Object Injection via 'checkout-email' Parameter
≤4.4.10Update to 4.4.11
- High7.2Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
≤4.4.10Update to 4.4.11
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.4.9Update to 4.4.9.1
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
≤4.4.8Update to 4.4.9
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
≤4.4.1Update to 4.4.2
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
≤4.3.2.8Update to 4.3.3
- Critical10.0Unauthenticated SQL Injection via 'c_fields'
≤4.2.7Update to 4.2.7.1
- Critical10.0Unauthenticated SQL Injection via 'c_only_fields'
≤4.2.7Update to 4.2.7.1
- High8.8Authenticated (Contributor+) SQL Injection via order Parameter
≤4.2.6.9.3Update to 4.2.6.9.4
- High8.8Authenticated (Contributor+) Local File Inclusion
≤4.2.6.8.2Update to 4.2.6.9
- Critical9.8Unauthenticated Time-Based SQL Injection
≤4.2.6.5Update to 4.2.6.6
- High8.8Authenticated (Instructor+) Arbitrary File Upload
≤4.2.6.5Update to 4.2.6.6
- High8.8Cross-Site Request Forgery to Privilege Escalation
≤4.0.0Update to 4.0.1
- High8.1Command Injection
≤4.2.5.7Update to 4.2.5.8
- Critical9.8Unauthenticated SQL Injection via order_by
≤4.2.5.7Update to 4.2.5.8
- High7.3Missing Authorization to Information Exposure
≤4.2.3Update to 4.2.3.1
- Critical9.8Unauthenticated Local File Inclusion
≤4.1.7.3.2Update to 4.2.0
- Critical9.8Unauthenticated SQL Injection
≤4.1.7.3.2Update to 4.2.0
- High8.8Authenticated (Subscriber+) SQL Injection
≤4.1.7.3.2Update to 4.2.0
- Critical9.8Unauthenticated PHP Object Injection
≤4.1.7.1Update to 4.1.7.2
- Critical9.8Authenticated SQL Injection
<4.1.4Update to 4.1.4
- High8.8SQL Injection
≤3.2.6.7Update to 3.2.6.8
- High8.8SQL Injection
≤3.2.7.2Update to 3.2.7.3
- High8.1Privilege Escalation via accept-to-be-teacher action parameter
≤3.2.6.8Update to 3.2.6.9
- High7.1Authenticated Page Creation and Status Modification
≤3.2.6.8Update to 3.2.6.9
- High7.1Privilege Escalation
≤3.2.6.6Update to 3.2.6.8
- High7.2Authenticated SQL Injection
≤3.0.12Update to 3.1.0
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: common questions
Does LearnPress – WordPress LMS Plugin for Create and Sell Online Courses have known vulnerabilities?
Yes. VulnCrest Radar lists 103 known vulnerabilities in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: 10 critical, 17 high, 76 medium. At least one is not fixed in the latest version.
How do I check which version of LearnPress – WordPress LMS Plugin for Create and Sell Online Courses I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent LearnPress – WordPress LMS Plugin for Create and Sell Online Courses vulnerability?
CVE-2026-52713, published Nov 7, 2026: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.12 - Missing Authorization. Severity: Medium (CVSS 4.3).
Is any LearnPress – WordPress LMS Plugin for Create and Sell Online Courses vulnerability listed in CISA KEV?
No. None of the known LearnPress – WordPress LMS Plugin for Create and Sell Online Courses vulnerabilities is currently listed in the CISA KEV catalog.