CVE-2025-14798: LearnPress LMS Information Disclosure

CVE-2025-14798 Overview

The LearnPress – WordPress LMS Plugin for WordPress contains a Sensitive Information Exposure vulnerability in versions up to and including 4.3.2.4. The vulnerability exists within the get_item_permissions_check function, which fails to properly restrict access to user data. This allows unauthenticated attackers to extract sensitive information including user first names, last names, social profile links, and enrollment data through the plugin's REST API endpoints.

Critical Impact

Unauthenticated attackers can extract sensitive user data including personal names, social profile information, and course enrollment details from WordPress sites using the vulnerable LearnPress plugin.

Affected Products

• LearnPress – WordPress LMS Plugin versions up to and including 4.3.2.4
• WordPress sites utilizing the LearnPress LMS functionality
• Any WordPress installation with the vulnerable REST API endpoints exposed

Discovery Timeline

• 2026-01-20 - CVE CVE-2025-14798 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-14798

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), which occurs when the software does not perform or incorrectly performs authorization checks for a critical function. In the context of LearnPress, the get_item_permissions_check function within the REST API user controller fails to adequately verify that incoming requests have proper authorization before returning sensitive user data.

The vulnerability can be exploited over the network without requiring any authentication, user interaction, or special privileges. While the confidentiality impact is limited to user profile information rather than system-level data, the exposure of personal information such as names and social profiles raises significant privacy concerns and could facilitate social engineering attacks against affected users.

Root Cause

The root cause lies in the class-lp-rest-users-v1-controller.php file, specifically in how the REST API handles permission checks for user data retrieval. The get_item_permissions_check function does not properly validate whether the requesting party has authorization to access user information, effectively allowing any unauthenticated request to retrieve sensitive user details. This represents a fundamental authorization bypass in the plugin's REST API architecture.

Attack Vector

The attack vector is network-based, requiring only HTTP access to the WordPress site's REST API endpoints. An attacker can craft API requests to the LearnPress user endpoints without providing authentication credentials. The vulnerable endpoint processes these requests and returns user data including first names, last names, social profile URLs, and course enrollment information.

The attack can be executed by sending crafted HTTP requests to the LearnPress REST API user endpoints. Due to the missing authorization check, the API responds with user data regardless of whether the requester is authenticated. For technical details on the vulnerable code paths, see the WordPress LearnPress Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-14798

Indicators of Compromise

• Unusual spikes in REST API requests targeting LearnPress user endpoints
• High volume of unauthenticated requests to /wp-json/learnpress/v1/users/ endpoints
• Access logs showing enumeration patterns against user data endpoints
• Requests from suspicious IP addresses or automated tools targeting LMS functionality

Detection Strategies

• Monitor WordPress access logs for repeated requests to LearnPress REST API endpoints without authentication tokens
• Implement Web Application Firewall (WAF) rules to detect and block bulk user data extraction attempts
• Review server logs for unusual patterns of API access from single IP addresses or known scanner user agents
• Configure alerting for abnormal volumes of REST API traffic to LearnPress endpoints

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests, particularly for LearnPress namespaced endpoints
• Implement rate limiting on REST API endpoints to slow potential enumeration attacks
• Use security plugins that provide REST API monitoring and anomaly detection capabilities
• Regularly audit access logs for signs of reconnaissance or data harvesting activity

How to Mitigate CVE-2025-14798

Immediate Actions Required

• Update LearnPress plugin to the latest patched version beyond 4.3.2.4
• Audit access logs to determine if the vulnerability has been exploited against your installation
• Review exposed user data and notify affected users if data breach is confirmed
• Temporarily disable LearnPress REST API endpoints if immediate patching is not possible

Patch Information

Update the LearnPress – WordPress LMS Plugin to the latest available version that includes the security fix. The vulnerability affects all versions up to and including 4.3.2.4. Administrators should check the WordPress plugin repository for the most recent release and apply updates through the WordPress admin dashboard or via WP-CLI.

For additional vulnerability details and patch information, refer to the Wordfence Vulnerability Report.

Workarounds

• Implement server-level access controls to restrict access to LearnPress REST API endpoints to authenticated users only
• Use a Web Application Firewall (WAF) to block unauthenticated requests to vulnerable API paths
• Disable the LearnPress REST API entirely if the functionality is not required for your LMS implementation
• Configure .htaccess or nginx rules to require authentication for API endpoint access

# Example nginx configuration to restrict LearnPress API access
location ~* /wp-json/learnpress/v1/users {
    # Require authentication for user endpoint access
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    
    # Alternatively, block unauthenticated access entirely
    # deny all;
    
    try_files $uri $uri/ /index.php?$args;
}