CVE-2026-11988

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.3.9.2

Description An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or higher can exploit the userId parameter to view course enrollment progress and completion data of users with the LP TEACHER ROLE or administrator roles. This issue does not affect regular subscribers as cross-subscriber access is blocked.

Recommendations Update to a version newer than 4.3.9.1. Avoid using the userId parameter in requests until the update is applied.