CVE-2025-11372: LearnPress LMS Privilege Escalation Flaw

CVE-2025-11372 Overview

CVE-2025-11372 is a missing authorization vulnerability [CWE-862] in the LearnPress – WordPress LMS Plugin for WordPress. The flaw affects all versions up to and including 4.2.9.2. The Admin Tools REST endpoints register their permission_callback as __return_true, bypassing capability checks entirely. Unauthenticated attackers can invoke these endpoints to perform destructive database operations. Impact includes dropping indexes on arbitrary tables (including WordPress core tables such as wp_options), creating duplicate configuration entries, and degrading site performance through the /wp-json/lp/v1/admin/tools/create-indexs endpoint when attackers supply table names.

Critical Impact

Unauthenticated attackers can modify database structure on any WordPress site running LearnPress ≤ 4.2.9.2, degrading availability and integrity of the site database.

Affected Products

• LearnPress – WordPress LMS Plugin, all versions ≤ 4.2.9.2
• WordPress sites exposing the plugin's /wp-json/lp/v1/admin/tools/ REST namespace
• Fixed in LearnPress 4.2.9.4

Discovery Timeline

• 2025-10-18 - CVE-2025-11372 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11372

Vulnerability Analysis

The vulnerability resides in inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php. Several administrative REST routes register with permission_callback => '__return_true', which unconditionally authorizes any caller. Affected routes include create-indexs, list-tables-indexs, clean-tables, and admin-notices.

Because these endpoints accept table names as input and pass them to database helpers in inc/Databases/class-lp-db.php, an unauthenticated request can invoke CREATE INDEX, DROP INDEX, and cleanup routines against arbitrary tables. Dropping indexes on high-traffic core tables such as wp_options or wp_posts degrades query performance and can render sites unresponsive.

Root Cause

The root cause is a failure to enforce capability checks on privileged REST routes. The developer used the WordPress helper __return_true — a boolean stub — as the permission gate. This pattern grants public access to endpoints intended for administrators only, mapping directly to [CWE-862] Missing Authorization.

Attack Vector

Exploitation requires only network access to the WordPress REST API. The attacker sends an HTTP POST request to /wp-json/lp/v1/admin/tools/create-indexs (or a sibling tool endpoint) with a target table name in the request body. No authentication, session cookie, or nonce is required.

// Patch from LearnPress 4.2.9.4 — restores capability enforcement
array(
    'methods'             => WP_REST_Server::CREATABLE,
    'callback'            => array( $this, 'create_indexes' ),
-   'permission_callback' => '__return_true',
+   'permission_callback' => array( $this, 'check_permission' ),
),
array(
    'methods'             => WP_REST_Server::CREATABLE,
    'callback'            => array( $this, 'get_list_tables_indexs' ),
-   'permission_callback' => '__return_true',
+   'permission_callback' => array( $this, 'check_permission' ),
),
array(
    'methods'             => WP_REST_Server::CREATABLE,
    'callback'            => array( $this, 'clean_tables' ),
-   'permission_callback' => '__return_true',
+   'permission_callback' => array( $this, 'check_permission' ),
),

Source: GitHub Commit cf940a4

Detection Methods for CVE-2025-11372

Indicators of Compromise

• Unauthenticated POST requests to /wp-json/lp/v1/admin/tools/create-indexs, /list-tables-indexs, /clean-tables, or /admin-notices
• Sudden appearance or removal of indexes on WordPress core tables such as wp_options, wp_posts, or wp_users
• Duplicate configuration rows in wp_options or unexpected slowdowns on autoload queries
• Web server access logs showing requests to the LearnPress admin REST namespace without a preceding authenticated session

Detection Strategies

• Inspect access logs for requests matching the regex /wp-json/lp/v1/admin/tools/(create-indexs|list-tables-indexs|clean-tables|admin-notices)
• Correlate REST API hits with the absence of authentication cookies or X-WP-Nonce headers
• Baseline database schema and alert on unauthorized CREATE INDEX or DROP INDEX statements against non-LearnPress tables

Monitoring Recommendations

• Enable WordPress REST API request logging via a web application firewall (WAF)
• Monitor MySQL slow query logs for regressions consistent with missing indexes
• Alert on schema-change events using MySQL audit plugins or cloud database activity logs

How to Mitigate CVE-2025-11372

Immediate Actions Required

• Update the LearnPress plugin to version 4.2.9.4 or later on all WordPress installations
• Audit wp_options and other core tables for missing indexes or duplicate entries and restore from backup if tampering is detected
• Deploy WAF rules that block unauthenticated requests to the lp/v1/admin/tools/ REST namespace until patching is complete

Patch Information

The vendor addressed the issue in LearnPress 4.2.9.4 by replacing __return_true with a proper check_permission callback across the affected admin routes. Details are available in the GitHub Commit cf940a4 and the Wordfence Vulnerability Advisory.

Workarounds

• Block external access to /wp-json/lp/v1/admin/tools/* at the reverse proxy or WAF layer
• Restrict WordPress REST API access to authenticated users using an access-control plugin until the patch is applied
• Temporarily deactivate LearnPress on sites that cannot be patched immediately

# Nginx snippet to block unauthenticated access to the vulnerable REST namespace
location ~ ^/wp-json/lp/v1/admin/tools/ {
    if ($http_cookie !~ "wordpress_logged_in_") {
        return 403;
    }
}