CVE-2026-127213

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user id parameter to the render button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load content via ajax REST route, which only requires a public wp rest nonce, to add or remove courses from any user's wishlist and determine whether a given course is wishlisted by iterating user id and course id values.