CVE-2025-22739 Overview
CVE-2025-22739 is a Missing Authorization vulnerability in the ThimPress LearnPress plugin for WordPress. The flaw affects all LearnPress versions up to and including 4.2.7.5. LearnPress is a widely deployed learning management system (LMS) plugin used by educational sites and course creators on WordPress.
The vulnerability stems from incorrectly configured access control on plugin endpoints, classified under [CWE-862]. An unauthenticated remote attacker can reach functionality that should be restricted to privileged users. Successful exploitation exposes confidential information within the LMS.
Critical Impact
An unauthenticated attacker can bypass access control checks over the network and disclose data managed by LearnPress without user interaction.
Affected Products
- ThimPress LearnPress plugin for WordPress
- All versions from initial release through 4.2.7.5
- WordPress sites running LearnPress as a learning management system
Discovery Timeline
- 2025-03-27 - CVE-2025-22739 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22739
Vulnerability Analysis
CVE-2025-22739 is a Broken Access Control weakness in the LearnPress WordPress plugin. The plugin exposes one or more endpoints that fail to enforce capability checks before returning data. Because authentication is not required and the attack originates over the network, the barrier to exploitation is low.
The [CWE-862] Missing Authorization classification indicates the code path executes without verifying that the caller possesses the required permission. The impact is limited to confidentiality: integrity and availability of the site remain unaffected. In practice, this typically results in disclosure of course content, user progress, or configuration data intended for authenticated roles.
Root Cause
The root cause is the absence of a current_user_can() or equivalent capability check on a plugin action or REST route. Many WordPress plugin vulnerabilities in this class register AJAX handlers with wp_ajax_nopriv_ or REST endpoints without a permission_callback that properly validates the requester. LearnPress 4.2.7.5 and earlier ship this configuration on at least one handler that returns sensitive LMS data.
Attack Vector
Exploitation requires only network access to the target WordPress site. An attacker sends a crafted HTTP request to the vulnerable LearnPress endpoint. Because the plugin does not verify authorization, the server returns data that should be gated behind an instructor or administrator role. No user interaction and no prior authentication are required.
See the Patchstack Vulnerability Report for endpoint-level details.
Detection Methods for CVE-2025-22739
Indicators of Compromise
- Unauthenticated HTTP requests to /wp-admin/admin-ajax.php or /wp-json/lp/ routes with LearnPress actions
- Repeated anonymous requests enumerating course, lesson, or user identifiers
- Unusual outbound data volumes from the WordPress site correlated with unauthenticated LearnPress calls
Detection Strategies
- Inspect web server access logs for requests to LearnPress AJAX actions without a valid wordpress_logged_in_* cookie
- Deploy a web application firewall (WAF) rule that flags LearnPress endpoints receiving unauthenticated traffic at high frequency
- Compare the installed LearnPress version against 4.2.7.5 across all managed WordPress sites
Monitoring Recommendations
- Enable verbose WordPress logging on plugin AJAX and REST routes
- Alert on HTTP 200 responses to unauthenticated LearnPress requests that return large payloads
- Track plugin inventory continuously and flag any site pinned to a vulnerable LearnPress build
How to Mitigate CVE-2025-22739
Immediate Actions Required
- Update LearnPress to a version later than 4.2.7.5 on every WordPress site in the environment
- Audit user roles and revoke unnecessary instructor or administrator privileges
- Review recent access logs for signs of endpoint abuse against LearnPress routes
Patch Information
ThimPress addressed the Broken Access Control issue in a release after LearnPress 4.2.7.5. Administrators should install the latest available LearnPress build from the WordPress plugin repository. Consult the Patchstack Vulnerability Report for fixed version details.
Workarounds
- Restrict access to LearnPress AJAX and REST endpoints at the WAF or reverse proxy until the plugin is upgraded
- Temporarily disable the LearnPress plugin on sites that cannot be patched immediately
- Limit exposure of course and user metadata by tightening REST API visibility with a hardening plugin
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
