CVE-2026-93882

Summary

The LearnPress WordPress plugin has an insecure direct object reference vulnerability that allows unauthenticated attackers to access course materials from paid or enrollment-required courses by exploiting a public AJAX endpoint. This occurs because the system uses two separate identifiers for authorization and data retrieval without properly validating that the lesson belongs to the authorized course.

Exploitability

The vulnerability is easily exploitable with no prerequisites as attackers can directly call the public lp-ajax-handle endpoint with any course_id and item_id parameters to access unauthorized course materials.

Blast radius

An attacker could potentially access all course material files from any paid or enrollment-required course on the site, including uploaded files and external URLs, if at least one course has 'No Required Enroll' enabled.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to LearnPress version 4.4.9 or later to fix this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.