CVE-2026-12732 Overview
CVE-2026-12732 is a Stored Cross-Site Scripting (XSS) vulnerability in the LearnPress plugin for WordPress affecting versions up to and including 4.4.0. The flaw resides in the class_wrapper_form shortcode attribute, which is rendered into an HTML class attribute without proper escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages. The injected payload executes in the browser of any user who visits the affected page. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Contributor-level authenticated users can inject persistent JavaScript that executes in the context of any visitor, enabling session theft, privilege escalation via administrator interaction, and defacement of course pages.
Affected Products
- LearnPress plugin for WordPress versions up to and including 4.4.0
- WordPress sites running LearnPress with contributor-or-higher user registration enabled
- Any LearnPress deployment exposing the FilterCourseShortcode handler
Discovery Timeline
- 2026-07-01 - CVE-2026-12732 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-12732
Vulnerability Analysis
The vulnerability exists in the LearnPress shortcode rendering pipeline. The FilterCourseShortcode::render() handler processes user-supplied shortcode attributes without applying shortcode_atts() filtering. Raw attributes are then forwarded through do_action('learn-press/filter-courses/layout', $data) and reach the template layer. In FilterCourseTemplate::sections() at line 98, the class_wrapper_form value is inserted into the output via sprintf('<form class="%s">', $class_wrapper_form). The absence of esc_attr() on this substitution allows attribute-context breakout, enabling script execution in the visitor's browser.
Root Cause
The root cause is missing input sanitization combined with missing output escaping. WordPress provides esc_attr() for HTML attribute contexts and shortcode_atts() for validating shortcode inputs. LearnPress omits both, permitting attacker-controlled data to reach the DOM verbatim. The stored nature of the injection means the payload persists in database-backed post content and executes on every page view.
Attack Vector
An attacker requires contributor-level access or higher on the target WordPress site. The attacker embeds a LearnPress filter-courses shortcode within a post or page and supplies a malicious class_wrapper_form attribute value. The payload breaks out of the class attribute using a double quote and injects an event handler such as onmouseover or onfocus. When any user, including administrators, views the published page, the script executes with that user's session context. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Template Hook source for the vulnerable code path.
Detection Methods for CVE-2026-12732
Indicators of Compromise
- Posts or pages containing LearnPress filter-course shortcodes with unusual class_wrapper_form attribute values containing quotes, angle brackets, or on* event handler strings
- Database rows in wp_posts where post_content includes class_wrapper_form= followed by non-alphanumeric characters
- Outbound requests from visitor browsers to attacker-controlled domains originating from LearnPress course pages
- New administrator accounts or modified user roles following contributor activity on the site
Detection Strategies
- Audit all posts authored by contributor-level accounts for embedded LearnPress shortcodes
- Scan post_content for regex patterns matching class_wrapper_form="[^"]*[<>"']
- Enable WordPress activity logging to correlate post edits with subsequent script execution events
- Deploy a Web Application Firewall rule that inspects shortcode attribute values for XSS payloads
Monitoring Recommendations
- Monitor content-security-policy violation reports for LearnPress course URLs
- Alert on privilege escalation events, particularly contributor-to-administrator role changes
- Track anomalous JavaScript execution and cookie-access patterns via browser-side telemetry
How to Mitigate CVE-2026-12732
Immediate Actions Required
- Update the LearnPress plugin to a version later than 4.4.0 that includes the fix referenced in the LearnPress Code Changeset
- Review and remove any suspicious LearnPress shortcodes authored by contributor-level users
- Rotate administrator session cookies and force password resets if injection is confirmed
Patch Information
The vendor addressed the issue by applying proper escaping in the template output and enforcing shortcode_atts() filtering in the shortcode handler. Review the fix in the LearnPress Code Changeset. Site administrators should upgrade to the patched release available through the WordPress plugin repository.
Workarounds
- Restrict contributor and author role assignments to trusted users only
- Disable the LearnPress plugin until the patched version can be deployed
- Deploy a Content Security Policy (CSP) that blocks inline scripts and event handlers on course pages
- Configure a WAF rule to strip or reject shortcode attributes containing quote or angle-bracket characters
# Configuration example: WordPress role restriction via wp-cli
wp user list --role=contributor --format=csv
wp role remove-cap contributor edit_posts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
