CVE-2025-13964: LearnPress WordPress Auth Bypass Flaw

CVE-2025-13964 Overview

The LearnPress – WordPress LMS Plugin for WordPress contains a Missing Authorization vulnerability (CWE-862) that allows unauthorized modification of data. The vulnerability exists due to a missing capability check on the catch_lp_ajax function in all versions up to, and including, 4.3.2. This security flaw enables unauthenticated attackers to modify course contents by adding, removing, updating, or re-ordering sections, as well as modifying section items within the learning management system.

Critical Impact

Unauthenticated attackers can manipulate course content and curriculum structure without any authentication, potentially compromising educational content integrity and user trust in affected WordPress LMS installations.

Affected Products

• LearnPress – WordPress LMS Plugin versions up to and including 4.3.2
• WordPress installations utilizing the LearnPress plugin
• Any website relying on LearnPress for course management functionality

Discovery Timeline

• January 6, 2026 - CVE-2025-13964 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-13964

Vulnerability Analysis

This vulnerability stems from improper access control implementation within the LearnPress plugin's AJAX handling mechanism. The catch_lp_ajax function, located in the plugin's core AJAX handling code, fails to verify whether the requesting user has the appropriate permissions to perform curriculum modification operations. Without proper capability checks, the plugin processes requests from any user, including unauthenticated visitors.

The vulnerability is classified under CWE-862 (Missing Authorization), which describes software that does not perform authorization checks when an actor attempts to access a resource or perform an action. In this case, the missing authorization check allows direct manipulation of course structures and content.

Root Cause

The root cause lies in the AbstractAjax.php file where the catch_lp_ajax function processes incoming AJAX requests without validating user capabilities. The function accepts and processes requests for curriculum editing operations without first confirming that the requester has instructor or administrator privileges. This architectural oversight in the AJAX request handling chain bypasses WordPress's built-in role and capability system.

Additionally, the EditCurriculumAjax.php file contains functions that perform section and item modifications but inherit the same lack of authorization checking from the parent abstract class.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication. An attacker can craft malicious AJAX requests targeting the LearnPress plugin endpoints to:

1. Add new sections to existing courses
2. Remove legitimate course sections or items
3. Modify the content and properties of existing sections
4. Re-order curriculum elements to disrupt course structure
5. Update section items with arbitrary content

The attack requires no user interaction and can be automated to target multiple WordPress installations running vulnerable versions of LearnPress.

For technical details on the vulnerable code paths, refer to the LearnPress Ajax Code Review and LearnPress Edit Curriculum Analysis.

Detection Methods for CVE-2025-13964

Indicators of Compromise

• Unexpected AJAX requests to LearnPress endpoints from unauthenticated sessions
• Unauthorized modifications to course content or curriculum structure
• Suspicious POST requests targeting wp-admin/admin-ajax.php with LearnPress-related actions
• Course section changes without corresponding authenticated user activity in logs
• Anomalous patterns in WordPress audit logs showing curriculum modifications

Detection Strategies

• Monitor web server access logs for unusual patterns of AJAX requests targeting LearnPress plugin endpoints
• Implement Web Application Firewall (WAF) rules to detect and block malicious curriculum modification attempts
• Review WordPress activity logs for unauthorized course content changes
• Set up alerts for course modifications that occur outside of normal administrative hours
• Use SentinelOne Singularity Platform to detect anomalous web application behavior and unauthorized data modification attempts

Monitoring Recommendations

• Enable comprehensive logging for all LearnPress plugin operations
• Configure real-time alerts for any curriculum modifications performed without valid authentication
• Implement file integrity monitoring on WordPress plugin directories
• Regularly audit course content for unexpected changes
• Deploy endpoint protection with SentinelOne to identify and respond to exploitation attempts

How to Mitigate CVE-2025-13964

Immediate Actions Required

• Update LearnPress plugin to the latest patched version immediately
• Review all course content for unauthorized modifications that may have occurred prior to patching
• Temporarily disable the LearnPress plugin if immediate update is not possible
• Implement additional WAF rules to filter malicious AJAX requests
• Conduct a security audit of your WordPress installation to identify any signs of compromise

Patch Information

Organizations running LearnPress should update to the latest version available beyond 4.3.2. Check the official WordPress plugin repository for the most recent security release. Additional technical details and vulnerability analysis are available through the Wordfence Vulnerability Report.

Workarounds

• Implement server-level access controls to restrict AJAX endpoint access to authenticated users only
• Use a Web Application Firewall to filter suspicious requests targeting LearnPress AJAX endpoints
• Temporarily disable the plugin and use alternative course management methods until patching is complete
• Add custom capability checks in a mu-plugin as a temporary measure until official patch is applied

# WordPress plugin update via WP-CLI
wp plugin update learnpress --version=latest

# Verify current LearnPress version
wp plugin get learnpress --field=version

# Check for any pending plugin updates
wp plugin list --update=available --format=table