CVE-2026-110363 Overview
CVE-2026-110363 is a Missing Authorization vulnerability [CWE-862] affecting the ThimPress LearnPress plugin for WordPress. The flaw stems from incorrectly configured access control security levels in the plugin's request handlers. Authenticated users with low-level privileges can invoke functionality that should be restricted to higher-privileged roles. The issue affects LearnPress versions up to and including 4.4.10. Patchstack published the advisory and tracks the issue as a broken access control vulnerability in the LearnPress learning management system plugin.
Critical Impact
Authenticated attackers with low privileges can bypass authorization checks on LearnPress endpoints, leading to limited confidentiality and integrity impact across course content and plugin-managed data.
Affected Products
- ThimPress LearnPress WordPress plugin
- LearnPress versions through 4.4.10
- WordPress sites running the LearnPress learning management system
Discovery Timeline
- 2026-10-19 - CVE-2026-110363 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-110363
Vulnerability Analysis
The vulnerability is a Missing Authorization weakness in the LearnPress plugin. LearnPress exposes functionality through WordPress action handlers and AJAX endpoints that require privilege checks before performing state-changing operations. One or more of these handlers do not enforce the correct capability or role check before executing their logic. An authenticated attacker holding a low-privilege account, such as a Subscriber or Student role, can call these endpoints and perform actions reserved for instructors or administrators. The resulting impact is limited to confidentiality and integrity of plugin-managed resources, with no direct availability impact.
Root Cause
The root cause is an incorrectly configured access control security level [CWE-862]. The plugin relies on request routing without consistently invoking current_user_can() checks or verifying ownership of the targeted resource. When authorization is not evaluated against the acting user's role, LearnPress treats any authenticated session as valid for the operation.
Attack Vector
Exploitation requires network access to the WordPress site and a valid authenticated session with low privileges. User interaction is not required. The attacker sends crafted requests to the vulnerable LearnPress endpoint to trigger the protected action. See the Patchstack Vulnerability Report for additional technical context.
// No verified proof-of-concept code is available.
// Refer to the Patchstack advisory for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-110363
Indicators of Compromise
- Unexpected modifications to LearnPress courses, lessons, quizzes, or enrollment records performed by non-instructor accounts.
- WordPress audit log entries showing low-privilege users invoking LearnPress AJAX actions or REST endpoints that normally require elevated roles.
- Access log entries containing LearnPress action parameters (lp-ajax, learnpress) originating from Subscriber or Student sessions.
Detection Strategies
- Review WordPress activity logs for LearnPress administrative actions performed outside the expected instructor and administrator user set.
- Correlate HTTP request logs with user role information to identify privilege mismatches on plugin endpoints.
- Baseline normal LearnPress API usage per role and alert on deviations such as Subscribers triggering course or user management actions.
Monitoring Recommendations
- Enable a WordPress security audit plugin to capture capability checks, role changes, and plugin-level actions.
- Forward web server access logs and WordPress audit events to a centralized SIEM for cross-user correlation.
- Monitor the wp-admin/admin-ajax.php endpoint for LearnPress action identifiers invoked by low-privilege sessions.
How to Mitigate CVE-2026-110363
Immediate Actions Required
- Upgrade LearnPress to a version later than 4.4.10 once the vendor publishes a fixed release.
- Audit existing LearnPress user accounts and remove unused Subscriber or Student accounts that could be used to exploit the issue.
- Review course content, enrollments, and grades for unauthorized changes performed before patching.
Patch Information
The Patchstack advisory tracks the vulnerability for LearnPress through version 4.4.10. Administrators should consult the Patchstack Vulnerability Report and the ThimPress LearnPress changelog for the fixed release version and apply it through the WordPress plugin updater.
Workarounds
- Restrict access to the WordPress site using an application firewall rule that blocks low-privilege users from reaching sensitive LearnPress endpoints until a patch is installed.
- Temporarily disable new user self-registration to reduce the pool of accounts available to attackers.
- Deactivate the LearnPress plugin on exposed sites that do not actively require it until a patched version is deployed.
# Example: update the LearnPress plugin via WP-CLI once a fixed version is published
wp plugin update learnpress
wp plugin list --name=learnpress --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
