The LearnPress – WordPress LMS Plugin for WordPress is affected by a missing capability check inside the catch_lp_ajax function in all releases up to and including 4.3.2. Because the function does not verify that the caller has the appropriate permissions, an attacker who has no authentication can send requests to the Ajax endpoint and perform a range of modifications to a course. These changes include adding, removing, updating, or re‑ordering sections and section items. The flaw allows an unauthenticated attacker to alter course data.

This vulnerability impacts the LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. All releases numbered up to and including version 4.3.2 are affected. Users running these versions should verify their plugin version and apply any updates as soon as they become available.

With a CVSS score of 5.3, the vulnerability is classified as moderate severity. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is exploitation of the Ajax endpoint without any authentication, allowing the attacker to directly send crafted requests to modify course data.