CVE-2026-93882

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.9

Description An Insecure Direct Object Reference exists via the CourseMaterialTemplate::render material items() callback exposed on the public lp-ajax-handle (load content via ajax) endpoint. The endpoint is included in the AbstractAjax no-nonce allowlist and lacks capability checks. The handler validates authorization using an attacker-supplied course id but fetches material rows using a separate attacker-supplied item id without verifying if the lesson belongs to the authorized course. This allows unauthenticated attackers to read and download course-material files from paid or enrollment-required courses, provided at least one course on the site has 'No Required Enroll' enabled and contains a material file.

Recommendations Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.9 or later.