CVE-2026-11988 Overview
CVE-2026-11988 affects the LearnPress WordPress LMS Plugin for Create and Sell Online Courses. The plugin fails to validate a user-controlled userId parameter in its REST API, exposing an Insecure Direct Object Reference (IDOR) [CWE-639]. Authenticated attackers with subscriber-level access or above can query the course enrollment progress and completion data belonging to any instructor or administrator on the site. The guard correctly blocks cross-subscriber access, so exploitation is limited to victim accounts holding the LP_TEACHER_ROLE or administrator role. All plugin versions up to and including 4.3.9.1 are affected.
Critical Impact
Any authenticated subscriber can enumerate course progress and completion data belonging to instructors and administrators, leaking learner activity and internal course participation records.
Affected Products
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (versions up to and including 4.3.9.1)
- WordPress sites using the vulnerable REST endpoint class-lp-rest-lazy-load-controller.php
- Fixed in LearnPress 4.4.0
Discovery Timeline
- 2026-07-01 - CVE-2026-11988 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-11988
Vulnerability Analysis
The vulnerability resides in the LearnPress REST API lazy-load controller. The endpoint accepts a userId parameter from the request and passes it directly into the user lookup routine without verifying that the requesting user is authorized to view data for the referenced account. Because the parameter is a direct object reference, attackers can substitute any numeric user ID to retrieve enrollment and progress records.
The plugin does enforce one guard: it blocks a subscriber from reading another subscriber's data. However, the check does not extend upward. Requests targeting users with the LP_TEACHER_ROLE or administrator role return the requested data, exposing enrollment progress and course completion records for privileged accounts.
Root Cause
The root cause is missing authorization on a user-controlled key, classified as [CWE-639] Authorization Bypass Through User-Controlled Key. The controller code at class-lp-rest-lazy-load-controller.php lines 118 and 137, along with the user helper at abstract-lp-user.php line 680, resolves the target user from the request payload without validating that the caller has permission to read that user's learning data.
Attack Vector
An attacker authenticates to the WordPress site with any subscriber-level account, including self-registered users on sites that allow open registration. The attacker then issues a request to the vulnerable LearnPress REST endpoint, iterating the userId parameter across candidate IDs. When the target ID belongs to an instructor or administrator, the API returns course enrollment progress and completion records for that user. No user interaction is required and the network attack path is remote.
Exploitation code is not required beyond a standard authenticated HTTP request against the LearnPress lazy-load REST route with a modified userId value. See the Wordfence Vulnerability Intelligence advisory and the WordPress LearnPress Controller Code for the affected code path.
Detection Methods for CVE-2026-11988
Indicators of Compromise
- Requests to the LearnPress REST endpoints under /wp-json/learnpress/v1/frontend/ containing a userId parameter that does not match the authenticated session user.
- Sequential or enumerative userId values in REST API logs originating from a single subscriber-level account.
- Elevated request volume from newly registered subscriber accounts targeting the lazy-load controller.
Detection Strategies
- Compare the authenticated user ID in the WordPress session with the userId parameter submitted to the LearnPress REST API and flag mismatches.
- Alert when subscriber-level accounts successfully query enrollment data for user IDs mapped to LP_TEACHER_ROLE or administrator roles.
- Baseline normal LearnPress API usage per role and flag deviations such as broad user ID enumeration.
Monitoring Recommendations
- Enable WordPress REST API request logging and forward web server access logs to a centralized analytics platform for correlation.
- Monitor authentication events for spikes in new subscriber registrations followed by REST API calls to LearnPress endpoints.
- Review LearnPress plugin logs for repeated lookups of high-privilege user IDs.
How to Mitigate CVE-2026-11988
Immediate Actions Required
- Upgrade the LearnPress plugin to version 4.4.0 or later on all affected WordPress sites.
- Audit REST API logs for prior enumeration of instructor or administrator userId values by subscriber accounts.
- Review self-registration settings and disable open subscriber registration where it is not required.
Patch Information
The vendor addressed the IDOR in LearnPress 4.4.0. The code changes between 4.3.9.1 and 4.4.0 are documented in the WordPress LearnPress Version Change diff. Administrators should apply the update through the WordPress plugin manager and verify the installed version reports 4.4.0 or higher.
Workarounds
- Restrict access to the /wp-json/learnpress/ REST namespace at the web application firewall to authenticated instructors and administrators until patching is complete.
- Temporarily disable the LearnPress plugin on sites where enrollment data confidentiality is required and patching cannot be applied immediately.
- Remove or downgrade unnecessary subscriber accounts and disable public user registration during the exposure window.
# Configuration example
# Update LearnPress via WP-CLI on affected WordPress hosts
wp plugin update learnpress --version=4.4.0
wp plugin get learnpress --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
