Technical impact
The LearnPress WordPress LMS Plugin allows an authenticated user with Editor or higher privileges to alter any WordPress option by sending an arbitrary option name in the field_name parameter of the learnpress_create_page AJAX request. The plugin only verifies that the user can edit pages and that a valid WP REST nonce is supplied; it does not whitelist the option key before calling update_option. Consequently, attackers can set critical WordPress settings such as users_can_register or active_plugins to values that enable public registration, disrupt plugin functionality, or otherwise compromise site integrity. This flaw is a missing authorization check (CWE‑862).
Affected Systems
All versions of thimpress LearnPress up to and including 4.4.4, which is a WordPress plugin that provides a learning management system for creating and selling online courses.
Risk and Exploitability
The CVSS score of 4.4 denotes low overall severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an account with Editor‑level or higher access to the WordPress site and the ability to invoke the learnpress_create_page AJAX endpoint, making the attack vector “Authenticated (local)”. While the EPSS score is unavailable, the lack of public exploits and the limited privilege requirement suggest a moderate risk to sites that rely on LearnPress for course management. However, any successful exploitation could lead to untrusted site-wide configuration changes.
