CVE-2026-104403: LearnPress Authorization Bypass Vulnerability

CVE-2026-104403 Overview

CVE-2026-104403 is an Insecure Direct Object Reference (IDOR) vulnerability in the ThimPress LearnPress plugin for WordPress. The flaw affects all versions through 4.4.9 and stems from authorization checks that rely on user-controlled keys without validating ownership. Unauthenticated attackers can send crafted network requests to access resources belonging to other users. The vulnerability is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact

Unauthenticated remote attackers can exploit improperly configured access control to read restricted LearnPress resources through object reference manipulation.

Affected Products

• ThimPress LearnPress WordPress plugin
• All versions from n/a through 4.4.9
• WordPress installations with the LearnPress Learning Management System (LMS) plugin enabled

Discovery Timeline

• 2026-10-02 - CVE-2026-104403 published to the National Vulnerability Database (NVD)
• 2026-10-03 - Last updated in NVD database

Technical Details for CVE-2026-104403

Vulnerability Analysis

The LearnPress plugin exposes endpoints that accept identifiers for user-owned resources such as course progress, quiz attempts, and order records. The affected code paths trust the supplied identifier without confirming that the authenticated session, or lack thereof, is permitted to access the referenced object. An attacker iterating through sequential or guessable identifiers can enumerate data that should be restricted to course owners, instructors, or enrolled students.

Because the attack vector is network-based and requires no authentication or user interaction, exploitation can be fully automated against exposed WordPress sites. The impact is limited to confidentiality; integrity and availability are not affected according to the published scoring vector.

Root Cause

The root cause is a missing or incomplete authorization check in request handlers that process user-controlled object identifiers. The plugin uses the submitted key as a lookup value without validating that the requester owns the resource or has the role required to view it. This maps directly to [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

An attacker interacts with vulnerable LearnPress endpoints over HTTP or HTTPS and substitutes identifiers for records belonging to other users. No credentials, tokens, or social engineering are required. Successful requests return data associated with the referenced object, enabling horizontal information disclosure across the WordPress site. Refer to the Patchstack WordPress Vulnerability Advisory for endpoint-level technical details.

Detection Methods for CVE-2026-104403

Indicators of Compromise

• Unauthenticated HTTP requests to LearnPress REST or AJAX endpoints that include numeric id, order_id, course_id, item_id, or user_id parameters.
• Sequential or rapidly incrementing identifier values from a single source IP suggesting enumeration.
• Elevated 200 OK response volume for endpoints that normally return 401 or 403 for unauthenticated callers.

Detection Strategies

• Review WordPress and reverse proxy access logs for high request volumes against /wp-json/lp/ or /wp-admin/admin-ajax.php with LearnPress actions.
• Alert when a single client enumerates object identifiers across a short window without a valid session cookie.
• Correlate anomalous LearnPress endpoint access with user-agent strings associated with automated scanning tools.

Monitoring Recommendations

• Ingest WordPress, web application firewall (WAF), and reverse proxy logs into a centralized analytics platform for enumeration pattern detection.
• Baseline normal LearnPress endpoint traffic per user and alert on deviations in request volume and identifier range.
• Monitor plugin version metadata across managed WordPress hosts to confirm patched builds remain in place.

How to Mitigate CVE-2026-104403

Immediate Actions Required

• Inventory all WordPress sites with the LearnPress plugin installed and identify any version at or below 4.4.9.
• Update LearnPress to the vendor-released fixed version as soon as it is available through the WordPress plugin repository.
• Restrict access to LearnPress REST and AJAX endpoints from unauthenticated sources where business requirements allow.

Patch Information

The vulnerability affects LearnPress through version 4.4.9. Administrators should consult the Patchstack WordPress Vulnerability Advisory and the ThimPress plugin changelog for the specific patched release and apply it across all affected sites.

Workarounds

• Deploy a WAF rule to block unauthenticated requests to LearnPress endpoints that reference user-specific object identifiers.
• Temporarily disable the LearnPress plugin on sites where patching cannot be performed immediately and course delivery can be paused.
• Enforce authentication on exposed LMS endpoints using reverse proxy or hosting-level access controls until the patched version is deployed.

# Example WAF rule concept - block unauthenticated enumeration of LearnPress object IDs
SecRule REQUEST_URI "@rx /wp-json/lp/v[0-9]+/" \
  "id:1041040,phase:1,deny,status:403,\
  chain,msg:'Block unauthenticated LearnPress IDOR enumeration (CVE-2026-104403)'"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"