The LearnPress WordPress LMS plugin has a missing capability check on several Admin Tools REST endpoints. The permission_callback for these endpoints is set to __return_true, which bypasses authentication entirely. An unauthenticated attacker can therefore send requests to endpoints such as /wp-json/lp/v1/admin/tools/create-indexs and execute destructive SQL operations. The attacker can drop indexes from any table—including core WordPress tables such as wp_options—create duplicate configuration entries, or otherwise degrade site performance. This vulnerability can compromise the integrity of the database and lead to site downtime, and it exposes the system to potential data loss. The weakness corresponds to CWE‑862: Missing Authorization.

Any WordPress installation that has the LearnPress LMS plugin version 4.2.9.2 or earlier is affected. The issue has been identified in all releases up to and including 4.2.9.2. The vulnerability is specific to the LearnPress plugin developed by thimpress. Sites running newer versions beyond 4.2.9.2 are not impacted by this particular flaw.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Because the endpoints are accessible without authentication, an attacker can exploit the flaw from any network location that can reach the site, typically over HTTP/HTTPS. No additional prerequisites are required beyond the ability to transmit REST API requests. Once exploited, the attacker can disrupt site operations or corrupt data, jeopardizing availability and integrity.