CVE-2025-11368: LearnPress Plugin Information Disclosure

CVE-2025-11368 Overview

CVE-2025-11368 is a sensitive information disclosure vulnerability affecting the LearnPress – WordPress LMS Plugin for WordPress. The flaw exists in all versions up to and including 4.2.9.4. The vulnerability stems from missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax, which permits arbitrary callback execution of admin-only template methods. Unauthenticated attackers can retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other restricted educational content through the REST API. Exploitation requires only that the attacker supply valid numeric IDs to reference the target content.

Critical Impact
Unauthenticated remote attackers can exfiltrate protected course content, including quiz answers and admin-only curriculum data, from any WordPress site running LearnPress 4.2.9.4 or earlier.

Affected Products

LearnPress – WordPress LMS Plugin versions up to and including 4.2.9.4
WordPress installations exposing the /wp-json/lp/v1/load_content_via_ajax REST endpoint
LearnPress deployments serving paid or gated course materials

Discovery Timeline

2025-11-21 - CVE-2025-11368 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11368

Vulnerability Analysis

CVE-2025-11368 is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). The LearnPress plugin registers a REST route at /wp-json/lp/v1/load_content_via_ajax intended to load course content dynamically. This endpoint accepts a callback identifier and a numeric object ID, then invokes the referenced template method server-side. The endpoint omits capability checks that normally restrict administrative template methods to authenticated administrators. As a result, callbacks intended for the admin UI execute in the context of unauthenticated REST requests. Any client that can reach the WordPress REST API can invoke these methods and receive the rendered content in the HTTP response.

Root Cause

The root cause is a missing authorization check in the LP_REST_Ajax_Controller class that registers and dispatches the REST callback. The controller accepts a caller-supplied method name and dispatches it without validating that the requester holds administrator capabilities. Because the same callback registry mixes public and admin-only template methods, the lack of a per-callback capability gate exposes admin methods to anonymous callers. See the WordPress LearnPress REST API code for the affected registration logic.

Attack Vector

Exploitation is performed over the network with no authentication and no user interaction. An attacker sends an HTTP request to /wp-json/lp/v1/load_content_via_ajax supplying the target admin callback name and a valid numeric course, lesson, or quiz ID. The endpoint dispatches the callback and returns the rendered HTML in the response body. Attackers can enumerate numeric IDs sequentially to harvest all protected content on the site. The Wordfence Vulnerability Report documents the exposed callbacks and confirms that quiz question and answer data can be retrieved through this path.

Detection Methods for CVE-2025-11368

Indicators of Compromise

Unauthenticated HTTP requests to /wp-json/lp/v1/load_content_via_ajax from external IP addresses
High-volume sequential enumeration of numeric id parameters against the LearnPress REST endpoint
REST responses containing admin curriculum HTML or quiz answer markup delivered to anonymous sessions
Access log entries referencing admin-only callback names in the request payload

Detection Strategies

Inspect web server and WordPress access logs for GET or POST requests to /wp-json/lp/v1/load_content_via_ajax lacking authentication cookies
Correlate REST endpoint hits with the absence of wordpress_logged_in_* cookies to identify anonymous access
Deploy a Web Application Firewall (WAF) rule that flags callback parameter values matching admin template method names

Monitoring Recommendations

Alert on abnormal request rates to any /wp-json/lp/v1/* route from a single source IP
Monitor outbound response sizes on the affected REST endpoint for large HTML payloads returned to unauthenticated clients
Track the installed LearnPress plugin version across managed WordPress sites and flag versions at or below 4.2.9.4

How to Mitigate CVE-2025-11368

Immediate Actions Required

Update the LearnPress plugin to version 4.3.0 or later on all WordPress sites
Audit REST access logs for the past 90 days to identify prior exploitation attempts against /wp-json/lp/v1/load_content_via_ajax
Rotate quiz questions and answers if logs indicate the endpoint was accessed by unauthenticated clients

Patch Information

The vendor addressed CVE-2025-11368 in LearnPress version 4.3.0. The fix introduces capability validation in the REST controller so that admin-scoped callbacks reject unauthenticated requests. Review the WordPress LearnPress version changes for the complete diff between 4.2.9.4 and 4.3.0.

Workarounds

Block external access to /wp-json/lp/v1/load_content_via_ajax at the reverse proxy or WAF until the patch is applied
Restrict the WordPress REST API to authenticated users using an access control plugin or custom rest_authentication_errors filter
Temporarily disable the LearnPress plugin on sites where an immediate upgrade to 4.3.0 is not feasible

bash

# Configuration example
# Nginx rule to block unauthenticated access to the vulnerable endpoint
location ~ ^/wp-json/lp/v1/load_content_via_ajax {
    if ($http_cookie !~ "wordpress_logged_in_") {
        return 403;
    }
}