The LearnPress WordPress LMS Plugin contains a flaw that allows authenticated users with subscriber-level access or higher to enroll in any paid course without paying. By sending a REST API request that includes a quantity value of zero, the plugin’s add_to_cart() function accepts the unsanitized parameter array, overrides the default cost, and calculates the order total as $0. This bypasses all configured payment gateways and makes the paid course effectively free, potentially resulting in revenue loss and abuse of the platform’s enrollment system.

This vulnerability affects all installations of the ThimPress LearnPress WordPress LMS Plugin up to and including version 4.3.5. The flaw lives in the cart handling code and the REST API controller responsible for course enrollment.

With a CVSS score of 4.3 the flaw is considered moderate in severity, and it is not currently listed in the CISA KEV catalog. The exploit requires the attacker to be an authenticated user with at least subscriber-level privileges, which is a relatively common role on WordPress sites, making the attack vector likely to be an internal credential compromise or social‑engineering campaign. Because the vulnerability does not grant arbitrary code execution or full system compromise, the impact is limited to monetary loss through unpaid enrollments, but it still poses a tangible business risk.