CVE-2026-78125 Overview
CVE-2026-78125 affects the LearnPress WordPress plugin in all versions up to and including 4.0.2. The plugin fails to perform authorization checks on one of its REST API endpoints. Unauthenticated attackers can query the endpoint and enumerate order identifiers to disclose the payment status of arbitrary orders. The issue is fixed in LearnPress 4.0.3.
Critical Impact
Unauthenticated remote attackers can enumerate order IDs against a vulnerable LearnPress REST endpoint and disclose payment status data for any order stored by the plugin.
Affected Products
- LearnPress WordPress plugin versions up to and including 4.0.2
- WordPress sites running LearnPress e-commerce order workflows
- Any deployment exposing the vulnerable REST endpoint to the public internet
Discovery Timeline
- 2026-08-27 - CVE-2026-78125 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-78125
Vulnerability Analysis
CVE-2026-78125 is a Broken Access Control issue in the LearnPress WordPress plugin. One of the plugin's REST API endpoints omits an authorization callback and does not validate that the requester owns or has permission to view the queried order. As a result, any unauthenticated HTTP client can send requests referencing arbitrary order identifiers.
The endpoint responds with the payment status associated with each queried order. Because order identifiers are sequential integers in LearnPress, an attacker can enumerate the identifier space to harvest payment status data across the entire order table. This exposes customer transaction telemetry and enables inference of purchasing activity, unfulfilled orders, and refund states.
The flaw sits at the API surface, so exploitation requires only network reachability to the WordPress site. No user account, cookie, or nonce is required. See the WPScan Vulnerability Report for the vendor-tracked technical write-up.
Root Cause
The root cause is a missing authorization check on a plugin-registered REST route. The route handler processes order lookup parameters without verifying capabilities such as read_shop_order or ownership of the referenced order object. WordPress permission_callback was effectively left permissive.
Attack Vector
An attacker sends unauthenticated HTTP GET requests to the vulnerable LearnPress REST endpoint, iterating over integer order IDs. Each response leaks the payment status of the referenced order. The attack is scriptable, low-complexity, and produces bulk disclosure of payment metadata without any user interaction.
No verified public exploit code is available. Refer to the linked WPScan advisory for endpoint specifics.
Detection Methods for CVE-2026-78125
Indicators of Compromise
- High-volume unauthenticated requests to LearnPress REST routes under /wp-json/lp/ referencing sequential order_id values
- Web server logs showing repeated 200 responses to a single REST endpoint from one source IP within a short window
- Absence of an authenticated WordPress session cookie or REST nonce on requests that return order payment data
Detection Strategies
- Alert on unauthenticated access patterns to /wp-json/ endpoints registered by LearnPress, especially routes that return order or payment fields
- Correlate spikes in 200-response counts against a single REST route with unique incrementing query parameters characteristic of ID enumeration
- Compare installed LearnPress plugin versions across the estate and flag any host still running 4.0.2 or earlier
Monitoring Recommendations
- Forward WordPress access logs and PHP-FPM logs to a centralized analytics platform for behavioral baselining
- Enable rate limiting and anomaly detection on REST endpoints exposed by e-commerce and LMS plugins
- Track plugin inventory and version drift as part of continuous configuration monitoring
How to Mitigate CVE-2026-78125
Immediate Actions Required
- Upgrade LearnPress to version 4.0.3 or later on every WordPress instance where the plugin is installed
- Review web server and application logs for prior enumeration of LearnPress REST order endpoints and identify affected customers
- Rotate any exposed transactional secrets or webhooks tied to order processing if reconnaissance is confirmed
Patch Information
The vendor addresses CVE-2026-78125 in LearnPress 4.0.3 by adding the missing authorization check to the vulnerable REST endpoint. Apply the update through the WordPress plugin manager or WP-CLI. Refer to the WPScan Vulnerability Report for advisory metadata.
Workarounds
- Restrict access to /wp-json/lp/ routes at the web application firewall until the plugin is upgraded
- Temporarily deactivate the LearnPress plugin on sites where an immediate upgrade is not feasible
- Block or rate-limit unauthenticated REST requests that enumerate integer identifiers against LearnPress endpoints
# Upgrade LearnPress via WP-CLI
wp plugin update learnpress --version=4.0.3
wp plugin get learnpress --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
