PT-2026-86407 · WordPress · Learndash Lms
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
LearnDash LMS versions 4.25.0 through 5.1.6
Description
An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the payment system to gain unauthorized access to premium educational content.
Recommendations
Update LearnDash LMS to a version later than 5.1.6.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Learndash Lms