Plugin security history

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 73 vulnerability records associated with LearnPress – WordPress LMS Plugin for Create and Sell Online Courses, published between 2018 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

73Total records

9Critical

14High

50Medium

0Low

0Informational

73Patched records

0Currently marked unpatched

2018-11-09First disclosure

2026-07-16Latest disclosure

68 of 73CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2018	3	3 records
2020	5	5 records
2021	4	4 records
2022	6	6 records
2023	6	6 records
2024	24	24 records
2025	11	11 records
2026	14	14 records

Severity Breakdown

Severity	Records	Share
Critical	9	12.3%
High	14	19.2%
Medium	50	68.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

23 records31.5%

First: 2018. Latest: 2026.

Missing Authorization

21 records28.8%

First: 2023. Latest: 2026.

SQL Injection

11 records15.1%

First: 2018. Latest: 2024.

Other

7 records9.6%

First: 2018. Latest: 2025.

Privilege Escalation

4 records5.5%

First: 2020. Latest: 2024.

Path Traversal

2 records2.7%

First: 2022. Latest: 2023.

CSRF

2 records2.7%

First: 2024. Latest: 2024.

Information Disclosure

2 records2.7%

First: 2024. Latest: 2025.

Arbitrary File Upload

1 record1.4%

First: 2024. Latest: 2024.

Patch Status

Patched: 73
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.4.2
4.4.1
4.4.0
4.3.7
4.3.6
4.3.3
4.3.4
4.3.2.5
4.3.2.2
4.3.2.1
4.3.2
4.3.0
4.2.9.4
4.2.7.6
4.2.7.5.1
4.2.7.4
4.2.7.2
4.2.7.1
4.2.6.9.4
4.2.6.9
4.2.6.8.2
4.2.6.8.1
4.2.6.7
4.2.6.6
4.2.6.5
4.0.1
4.2.6.4
4.2.5.8
4.2.5.4
4.2.3.1
4.2.0
4.1.7.2
4.1.6.8
4.1.6.6
4.1.6
4.1.5
4.1.4
4.1.3.2
4.1.3.1
3.2.6.8
3.2.7.3
3.2.6.9
3.1.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.4.1`	LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints	July 16, 2026	4.4.2	High
`*-4.4.0`	LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute	June 30, 2026	4.4.1	Medium
`*-4.3.9.1`	LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter	June 30, 2026	4.4.0	Medium
`*-4.4.0`	LearnPress <= 4.4.0 - Reflected Cross-Site Scripting	June 29, 2026	4.4.1	Medium
`*-4.3.6`	LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters	June 5, 2026	4.3.7	Medium
`*-4.3.6`	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting	June 1, 2026	4.3.7	Medium
`*-4.3.5`	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter	May 13, 2026	4.3.6	Medium
`*-4.3.2.8`	LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion	April 13, 2026	4.3.3	Critical
`*-4.3.3`	LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute	April 7, 2026	4.3.4	Medium
`*-4.3.2.8`	LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion	March 23, 2026	4.3.3	Medium
`*-4.3.2.8`	LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering	March 11, 2026	4.3.3	Medium
`*-4.3.2.4`	LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API	January 19, 2026	4.3.2.5	Medium
`*-4.3.2.1`	LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion	January 6, 2026	4.3.2.2	Medium
`*-4.3.2`	LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification	January 5, 2026	4.3.2.1	Medium
`*-4.3.1`	LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure	December 15, 2025	4.3.2	Medium
`*-4.3.1`	LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social	December 15, 2025	4.3.2	Medium
`*-4.2.9.4`	LearnPress <= 4.2.9.4 - Missing Authorization	November 30, 2025	4.3.0	Medium
`*-4.2.9.4`	LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure	November 20, 2025	4.3.0	Medium
`*-4.2.9.4`	LearnPress <= 4.2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	November 6, 2025	4.3.0	Medium
`*-4.2.9.3`	LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation	October 17, 2025	4.2.9.4	Medium
`*-4.2.7.5`	LearnPress <= 4.2.7.5 - Missing Authorization	March 27, 2025	4.2.7.6	Medium
`*-4.2.7.5`	LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting	January 29, 2025	4.2.7.5.1	Medium
`*-4.2.7.5`	LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting	January 29, 2025	4.2.7.5.1	Medium
`*-4.2.7.5`	LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name	January 24, 2025	4.2.7.5.1	Medium
`*-4.2.7.1`	LearnPress <= 4.2.7.1 - Authenticated (Subscriber+) Open Redirect	January 24, 2025	4.2.7.2	Medium

Selected source records

Latest Records

HighCVE-2026-13765

LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints

Published: July 16, 2026

Affected versions: *-4.4.1
Patched versions: 4.4.2

Original Wordfence record

MediumCVE-2026-12732

LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute

Published: June 30, 2026

Affected versions: *-4.4.0
Patched versions: 4.4.1

Original Wordfence record

MediumCVE-2026-11988

LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter

Published: June 30, 2026

Affected versions: *-4.3.9.1
Patched versions: 4.4.0

Original Wordfence record

MediumCVE-2026-12970

LearnPress <= 4.4.0 - Reflected Cross-Site Scripting

Published: June 29, 2026

Affected versions: *-4.4.0
Patched versions: 4.4.1

Original Wordfence record

MediumCVE-2026-8502

LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters

Published: June 5, 2026

Affected versions: *-4.3.6
Patched versions: 4.3.7

Original Wordfence record

MediumCVE-2026-48865

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting

Published: June 1, 2026

Affected versions: *-4.3.6
Patched versions: 4.3.7

Original Wordfence record

MediumCVE-2026-7648

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter

Published: May 13, 2026

Affected versions: *-4.3.5
Patched versions: 4.3.6

Original Wordfence record

CriticalCVE-2026-4365

LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion

Published: April 13, 2026

Affected versions: *-4.3.2.8
Patched versions: 4.3.3

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-8529

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'

Published: September 11, 2024

Affected versions: *-4.2.7
Patched versions: 4.2.7.1

Original Wordfence record

CriticalCVE-2024-8522

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'

Published: September 11, 2024

Affected versions: *-4.2.7
Patched versions: 4.2.7.1

Original Wordfence record

CriticalCVE-2024-4434

LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection

Published: May 9, 2024

Affected versions: *-4.2.6.5
Patched versions: 4.2.6.6

Original Wordfence record

CriticalCVE-2021-24951

LearnPress <= 4.1.3 - Authenticated SQL Injection

Published: November 9, 2021

Affected versions: [*, 4.1.4)
Patched versions: 4.1.4

Original Wordfence record

CriticalCVE-2023-6567

LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by

Published: January 2, 2024

Affected versions: *-4.2.5.7
Patched versions: 4.2.5.8

Original Wordfence record

CriticalCVE-2022-45808

LearnPress <= 4.1.7.3.2 - Unauthenticated SQL Injection

Published: January 20, 2023

Affected versions: *-4.1.7.3.2
Patched versions: 4.2.0

Original Wordfence record

CriticalCVE-2022-47615

LearnPress <= 4.1.7.3.2 - Unauthenticated Local File Inclusion

Published: January 20, 2023

Affected versions: *-4.1.7.3.2
Patched versions: 4.2.0

Original Wordfence record

CriticalCVE-2022-3360

LearnPress <= 4.1.7.1 - Unauthenticated PHP Object Injection

Published: October 3, 2022

Affected versions: *-4.1.7.1
Patched versions: 4.1.7.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory