CVE-2026-78125 in LearnPress Plugin
Summary
by MITRE • 08/27/2026
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in LearnPress WordPress plugin versions prior to 4.0.3 represents a critical failure in access control mechanisms within the application's REST API implementation. Specifically, one of the endpoints responsible for retrieving order details lacks any form of authorization check or authentication requirement. This architectural flaw allows unauthenticated actors to interact with the endpoint directly by sending HTTP requests without providing valid session cookies, tokens, or credentials that would normally be required to access protected resources within a WordPress environment. The absence of these checks means that the server processes the request and returns data based solely on the parameters provided in the query string or body, rather than verifying if the requester has legitimate permission to view the information associated with those parameters.
From a technical perspective, this issue falls under the category of Broken Access Control, which is consistently ranked as one of the most significant security risks for web applications according to OWASP standards. The specific nature of this flaw aligns closely with CWE-284, Improper Access Control, and more specifically CWE-306, Missing Authentication for Critical Function. By failing to validate whether the current user context is authorized to perform the action or access the data, the plugin exposes sensitive operational information to any internet-connected entity capable of crafting HTTP requests. This type of vulnerability often arises during development when developers assume that because a function exists within an admin-facing plugin, it will only be accessed by administrators, neglecting to enforce strict role-based checks on API endpoints that are exposed publicly or semi-publicly via the REST API infrastructure.
The operational impact of this vulnerability centers on the unauthorized disclosure of sensitive business intelligence and personal data. Attackers can exploit this flaw by enumerating order identifiers, which are typically sequential integers in WordPress databases. By iterating through a range of these IDs, an attacker can systematically retrieve payment status information for arbitrary orders. This capability allows malicious actors to determine whether specific transactions were completed successfully or if they failed, potentially revealing customer purchasing habits and financial behaviors. While the primary disclosed data is limited to payment status rather than full credit card details in this specific instance, such enumeration can be a precursor to more severe attacks. Knowledge of successful payments might encourage targeted phishing campaigns against customers who have recently made purchases, while knowledge of failed transactions could aid in fraud detection evasion or further exploitation attempts if other related vulnerabilities exist within the same system.
Furthermore, the ability to enumerate order IDs contributes directly to information disclosure risks outlined in the MITRE ATT&CK framework under techniques such as T1078, Valid Accounts, although here it is exploited without valid accounts due to the missing check, and potentially T1592, Gather Victim Host Information, by mapping out the scale of transactions. The exposure of payment statuses can also facilitate social engineering attacks where attackers impersonate support staff or use gathered data to craft convincing phishing emails that reference specific order details known only to legitimate customers. This erosion of trust can have significant reputational and financial consequences for businesses relying on LearnPress for their e-commerce operations, as it demonstrates a fundamental lack of security hygiene in handling sensitive transactional data.
To mitigate this vulnerability, immediate action is required by updating the LearnPress plugin to version 4.0.3 or later, where the developers have implemented proper authorization checks on the affected REST endpoint. Until an update can be applied, administrators should consider implementing web application firewall rules that restrict access to known vulnerable endpoints based on IP reputation or request patterns indicative of enumeration attacks. Additionally, reviewing other custom plugins and themes for similar missing authentication checks is advisable, as this pattern often indicates a broader lack of security awareness in the codebase. Regular security audits focusing on REST API implementations are essential to ensure that all exposed functions adhere to the principle of least privilege, ensuring that only authenticated users with appropriate roles can access sensitive data such as order details and payment statuses.