CVE-2025-13964

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin versions up to and including 4.3.2

Description The LearnPress – WordPress LMS Plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check within the catch lp ajax function. An unauthenticated attacker can exploit this to alter course content, including adding, removing, updating, or re-ordering sections and modifying section items.

Recommendations Update LearnPress – WordPress LMS Plugin to a version later than 4.3.2.