Plugin security history

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 73 vulnerability records associated with LearnPress – WordPress LMS Plugin for Create and Sell Online Courses, published between 2018 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

73Total records

9Critical

14High

50Medium

0Low

0Informational

73Patched records

0Currently marked unpatched

2018-11-09First disclosure

2026-07-16Latest disclosure

68 of 73CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2018	3	3 records
2020	5	5 records
2021	4	4 records
2022	6	6 records
2023	6	6 records
2024	24	24 records
2025	11	11 records
2026	14	14 records

Severity Breakdown

Severity	Records	Share
Critical	9	12.3%
High	14	19.2%
Medium	50	68.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

23 records31.5%

First: 2018. Latest: 2026.

Missing Authorization

21 records28.8%

First: 2023. Latest: 2026.

SQL Injection

11 records15.1%

First: 2018. Latest: 2024.

Other

7 records9.6%

First: 2018. Latest: 2025.

Privilege Escalation

4 records5.5%

First: 2020. Latest: 2024.

Path Traversal

2 records2.7%

First: 2022. Latest: 2023.

CSRF

2 records2.7%

First: 2024. Latest: 2024.

Information Disclosure

2 records2.7%

First: 2024. Latest: 2025.

Arbitrary File Upload

1 record1.4%

First: 2024. Latest: 2024.

Patch Status

Patched: 73
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.4.2
4.4.1
4.4.0
4.3.7
4.3.6
4.3.3
4.3.4
4.3.2.5
4.3.2.2
4.3.2.1
4.3.2
4.3.0
4.2.9.4
4.2.7.6
4.2.7.5.1
4.2.7.4
4.2.7.2
4.2.7.1
4.2.6.9.4
4.2.6.9
4.2.6.8.2
4.2.6.8.1
4.2.6.7
4.2.6.6
4.2.6.5
4.0.1
4.2.6.4
4.2.5.8
4.2.5.4
4.2.3.1
4.2.0
4.1.7.2
4.1.6.8
4.1.6.6
4.1.6
4.1.5
4.1.4
4.1.3.2
4.1.3.1
3.2.6.8
3.2.7.3
3.2.6.9
3.1.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`[*, 4.2.3.1)`	LearnPress <= 4.2.3 - Missing Authorization	July 6, 2023	4.2.3.1	Medium
`*-4.2.3`	LearnPress <= 4.2.3 - Missing Authorization to Information Exposure	July 4, 2023	4.2.3.1	High
`*-4.2.3`	LearnPress <= 4.2.3 - Missing Authorization	July 4, 2023	4.2.3.1	Medium
`*-4.1.7.3.2`	LearnPress <= 4.1.7.3.2 - Unauthenticated Local File Inclusion	January 20, 2023	4.2.0	Critical
`*-4.1.7.3.2`	LearnPress <= 4.1.7.3.2 - Unauthenticated SQL Injection	January 20, 2023	4.2.0	Critical
`*-4.1.7.3.2`	LearnPress <= 4.1.7.3.2 - Authenticated (Subscriber+) SQL Injection	December 20, 2022	4.2.0	High
`*-4.1.7.1`	LearnPress <= 4.1.7.1 - Unauthenticated PHP Object Injection	October 3, 2022	4.1.7.2	Critical
`*-4.1.6.7`	LearnPress – WordPress LMS Plugin <= 4.1.6.7 - Reflected Cross-Site Scripting	July 5, 2022	4.1.6.8	Medium
`*-4.1.6.5`	LearnPress – WordPress LMS Plugin <= 4.1.6.5 - Reflected Cross-Site Scripting	June 14, 2022	4.1.6.6	Medium
`[*, 4.1.6)`	LearnPress <= 4.1.5 - Reflected Cross-Site Scripting	March 16, 2022	4.1.6	Medium
`*-4.1.4.1`	LearnPress <= 4.1.4.1 - Arbitrary Image Renaming	January 26, 2022	4.1.5	Medium
`[*, 4.1.4)`	LearnPress <= 4.1.3 - Authenticated SQL Injection	November 9, 2021	4.1.4	Critical
`*-4.1.3.1`	LearnPress <= 4.1.3.1 - Stored Cross-Site Scripting via $custom_profile	October 18, 2021	4.1.3.2	Medium
`*-4.1.3`	LearnPress <= 4.1.3 - Authenticated Stored Cross-Site Scripting	September 20, 2021	4.1.3.1	Medium
`*-3.2.6.7`	LearnPress <= 3.2.6.7 - SQL Injection	July 19, 2021	3.2.6.8	High
`*-3.2.7.2`	LearnPress – WordPress LMS Plugin <= 3.2.7.2 - SQL Injection	October 5, 2020	3.2.7.3	High
`[*, 3.2.7.3)`	LearnPress <= 3.2.7.2 - Reflected Cross-Site Scripting	September 8, 2020	3.2.7.3	Medium
`*-3.2.6.8`	LearnPress <= 3.2.6.8 - Privilege Escalation via accept-to-be-teacher action parameter	April 20, 2020	3.2.6.9	High
`*-3.2.6.8`	LearnPress <= 3.2.6.8 - Authenticated Page Creation and Status Modification	April 19, 2020	3.2.6.9	High
`*-3.2.6.6`	LearnPress <= 3.2.6.6 - Privilege Escalation	March 16, 2020	3.2.6.8	High
`*-3.0.12`	LearnPress <= 3.0.12 - Cross-Site Scripting	November 9, 2018	3.1.0	Medium
`*-3.0.12`	LearnPress <= 3.0.12 - Open Redirect	November 9, 2018	3.1.0	Medium
`*-3.0.12`	LearnPress <= 3.0.12 - Authenticated SQL Injection	November 9, 2018	3.1.0	High

Selected source records

Latest Records

HighCVE-2026-13765

LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints

Published: July 16, 2026

Affected versions: *-4.4.1
Patched versions: 4.4.2

Original Wordfence record

MediumCVE-2026-12732

LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute

Published: June 30, 2026

Affected versions: *-4.4.0
Patched versions: 4.4.1

Original Wordfence record

MediumCVE-2026-11988

LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter

Published: June 30, 2026

Affected versions: *-4.3.9.1
Patched versions: 4.4.0

Original Wordfence record

MediumCVE-2026-12970

LearnPress <= 4.4.0 - Reflected Cross-Site Scripting

Published: June 29, 2026

Affected versions: *-4.4.0
Patched versions: 4.4.1

Original Wordfence record

MediumCVE-2026-8502

LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters

Published: June 5, 2026

Affected versions: *-4.3.6
Patched versions: 4.3.7

Original Wordfence record

MediumCVE-2026-48865

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting

Published: June 1, 2026

Affected versions: *-4.3.6
Patched versions: 4.3.7

Original Wordfence record

MediumCVE-2026-7648

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter

Published: May 13, 2026

Affected versions: *-4.3.5
Patched versions: 4.3.6

Original Wordfence record

CriticalCVE-2026-4365

LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion

Published: April 13, 2026

Affected versions: *-4.3.2.8
Patched versions: 4.3.3

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-8529

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'

Published: September 11, 2024

Affected versions: *-4.2.7
Patched versions: 4.2.7.1

Original Wordfence record

CriticalCVE-2024-8522

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'

Published: September 11, 2024

Affected versions: *-4.2.7
Patched versions: 4.2.7.1

Original Wordfence record

CriticalCVE-2024-4434

LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection

Published: May 9, 2024

Affected versions: *-4.2.6.5
Patched versions: 4.2.6.6

Original Wordfence record

CriticalCVE-2021-24951

LearnPress <= 4.1.3 - Authenticated SQL Injection

Published: November 9, 2021

Affected versions: [*, 4.1.4)
Patched versions: 4.1.4

Original Wordfence record

CriticalCVE-2023-6567

LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by

Published: January 2, 2024

Affected versions: *-4.2.5.7
Patched versions: 4.2.5.8

Original Wordfence record

CriticalCVE-2022-45808

LearnPress <= 4.1.7.3.2 - Unauthenticated SQL Injection

Published: January 20, 2023

Affected versions: *-4.1.7.3.2
Patched versions: 4.2.0

Original Wordfence record

CriticalCVE-2022-47615

LearnPress <= 4.1.7.3.2 - Unauthenticated Local File Inclusion

Published: January 20, 2023

Affected versions: *-4.1.7.3.2
Patched versions: 4.2.0

Original Wordfence record

CriticalCVE-2022-3360

LearnPress <= 4.1.7.1 - Unauthenticated PHP Object Injection

Published: October 3, 2022

Affected versions: *-4.1.7.1
Patched versions: 4.1.7.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory