The LearnPress WordPress LMS plugin is vulnerable to an insecure direct object reference that permits a teacher‑level user to delete lesson material belonging to another teacher. The flaw originates from a mismatch between the DELETE REST API endpoint and the authorization check: the endpoint extracts the target file identifier from the URL path, while the permission check validates a different ID supplied in the request body. This allows an authenticated teacher to craft a DELETE request with their own item_id value to pass authorization and target another teacher’s file_id, leading to unauthorized file deletion. As a result, legitimate instructional resources can be removed, disrupting course delivery and damaging educators’ confidence in the platform.

All installations of the Thimpress LearnPress WordPress LMS plugin on WordPress sites that run any version up to and including 4.3.2.2 are affected. The vulnerability is triggered by the REST API endpoint "/wp-json/lp/v1/material/{file_id}". Versions 4.3.2.3 and later are not known to contain the flaw.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is below 1 %, suggesting a very low exploitation probability under current conditions. The vulnerability is not listed in the CISA KEV catalog. An attacker needs only to be authenticated with teacher‑level privileges and to be able to make a DELETE request to the exposed endpoint. Once those prerequisites are met, the attacker can delete any material file owned by another teacher, potentially erasing course content and compromising instructional integrity.