CVE-2026-3226: LearnPress WordPress Plugin Auth Bypass Flaw

CVE-2026-3226 Overview

The LearnPress – WordPress LMS Plugin for WordPress contains a missing authorization vulnerability that allows authenticated attackers to trigger unauthorized email notifications. The vulnerability exists in all 10 functions within the SendEmailAjax class in versions up to and including 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but fails to perform a current_user_can() capability check before dispatching to handler functions. Since the wp_rest nonce is embedded in frontend JavaScript for all authenticated users, attackers with Subscriber-level access or higher can exploit this flaw.

Critical Impact

Authenticated attackers with minimal privileges can trigger arbitrary email notifications to administrators, instructors, and users, enabling email flooding, social engineering campaigns, and impersonation of administrative decisions regarding instructor requests.

Affected Products

• LearnPress – WordPress LMS Plugin versions up to and including 4.3.2.8
• WordPress installations running vulnerable LearnPress versions
• LMS platforms utilizing LearnPress for course management

Discovery Timeline

• 2026-03-12 - CVE CVE-2026-3226 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3226

Vulnerability Analysis

This vulnerability represents a classic Missing Authorization flaw (CWE-862) in the LearnPress plugin's AJAX handling mechanism. The core issue lies in the architectural design of the AbstractAjax class, which implements nonce verification without corresponding capability checks.

When a request is received, the catch_lp_ajax() method validates the wp_rest nonce to prevent cross-site request forgery attacks. However, nonce verification alone only confirms that the request originated from a logged-in user on the site—it does not verify whether that user should be authorized to perform the requested action.

The SendEmailAjax class contains 10 handler functions that can trigger various email notifications within the LMS ecosystem. These functions can send emails to administrators regarding instructor applications, course enrollment notifications, and other critical communications. Without proper current_user_can() checks, any authenticated user—including those with the lowest "Subscriber" role—can invoke these email functions.

Root Cause

The root cause is the absence of WordPress capability checks (current_user_can()) in the AbstractAjax::catch_lp_ajax() dispatcher method. The developers correctly implemented CSRF protection through nonce verification but failed to implement the complementary authorization layer. This creates a situation where authentication (proving who you are) is verified, but authorization (proving what you're allowed to do) is not enforced. The wp_rest nonce, being available to all authenticated users through frontend JavaScript at LP Assets Class, provides attackers with the necessary token to pass the nonce check.

Attack Vector

An attacker needs only a valid WordPress account with Subscriber-level privileges to exploit this vulnerability. The attack flow involves:

1. Authenticating to the WordPress site as a Subscriber
2. Extracting the wp_rest nonce from the frontend JavaScript
3. Crafting AJAX requests to invoke any of the 10 SendEmailAjax handler functions
4. Triggering email notifications to administrators, instructors, or other users at will

The vulnerability is exploited via network requests (CVSS Attack Vector: Network) and requires low privileges with no user interaction needed. While the integrity impact is limited, the potential for abuse through email flooding and social engineering is significant.

The vulnerable dispatcher logic can be examined in the AbstractAjax.php source file, while the email handler functions are defined in SendEmailAjax.php. The fix implemented in version 4.3.3 adds proper capability checks, as shown in the file changeset.

Detection Methods for CVE-2026-3226

Indicators of Compromise

• Unusual volume of LearnPress AJAX requests from low-privileged user accounts
• Spike in outgoing emails from LMS-related notification functions
• Multiple AJAX calls to SendEmailAjax endpoints from Subscriber accounts
• Complaints from administrators or instructors about unexpected email notifications

Detection Strategies

• Monitor web server logs for repeated POST requests to LearnPress AJAX endpoints containing SendEmailAjax actions
• Implement rate limiting on AJAX endpoints to detect potential email flooding attempts
• Audit WordPress user activity logs for Subscribers making administrative-level requests
• Review email server logs for unusual patterns in LMS notification delivery

Monitoring Recommendations

• Configure Web Application Firewall (WAF) rules to flag excessive AJAX requests from low-privilege authenticated sessions
• Enable WordPress audit logging plugins to track AJAX action invocations by user role
• Set up alerts for unusual email volume originating from LearnPress notification functions
• Monitor for social engineering attempts that may follow email impersonation attacks

How to Mitigate CVE-2026-3226

Immediate Actions Required

• Update LearnPress plugin to version 4.3.3 or later immediately
• Review recent email logs for signs of exploitation or abuse
• Audit Subscriber and low-privilege user accounts for suspicious activity
• Consider temporarily disabling email notifications if update cannot be applied immediately

Patch Information

The LearnPress development team has addressed this vulnerability in version 4.3.3. The patch adds proper current_user_can() capability checks to the AJAX handler functions in the SendEmailAjax class, ensuring that only users with appropriate permissions can trigger email notifications. The specific changes can be reviewed in the official changeset. For detailed vulnerability information, see the Wordfence Vulnerability Analysis.

Workarounds

• Restrict user registration to prevent untrusted accounts from obtaining Subscriber access
• Implement a WordPress security plugin with AJAX request monitoring capabilities
• Use server-level rate limiting on AJAX endpoints to mitigate email flooding potential
• Consider temporarily removing Subscriber role capabilities until patched

# Verify LearnPress version via WP-CLI
wp plugin list --name=learnpress --fields=name,version,update_version

# Update LearnPress to the patched version
wp plugin update learnpress

# Alternatively, check for affected versions in the database
wp db query "SELECT option_value FROM wp_options WHERE option_name = 'learnpress_version';"