Medium 6.5Published Oct 18, 2025

CVE-2025-11372LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation

Updated under an hour ago (Oct 27, 2026, 5:23 PM ET)

Does this affect you?

It affects thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

Exploited in the last 30 days

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin Tools REST endpoints which are registered with permission_callback set to __return_true. This makes it possible for unauthenticated attackers to perform destructive database operations including dropping indexes on any table (including WordPress core tables like wp_options), creating duplicate configuration entries, and degrading site performance via the /wp-json/lp/v1/admin/tools/create-indexs endpoint granted they can provide table names.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Wordfence
NVD analysis: Deferred
Record last updated: Apr 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses thimpress:learnpress_wordpress_lms_plugin_for_create_and_sell_online_courses (from the name)	through 4.2.9.3	CNA record

References

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/d2365e92-d70d-47fa-9abe-7cbdd6336f39?source=cve
https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L30
https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L101
https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/admin/class-lp-admin-rest-tools-controller.php#L145
https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Databases/class-lp-db.php#L291
https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Databases/class-lp-db.php#L316
https://github.com/LearnPress/learnpress/commit/cf940a437539a803e49136bdff7a53e1f2b2ca44

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.