CVE-2026-127213 · Other
NO FIX YET · SEE WHAT TO DO
The LearnPress Course Wishlist add-on trusts a user_id parameter instead of the logged-in session, so remote attackers can add or remove courses from any user's wishlist. Attackers can also enumerate user and course IDs to learn which courses a given user has wishlisted.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the LearnPress Course Wishlist add-on before 4.1.2 on WordPress are exposed through its public REST route, which needs only a public nonce rather than a logged-in session. Sites without this add-on, or with it at 4.1.2 or later, are not affected.
Not affected if plugin-not-installed, version-4.1.2-or-later
Who cares learnpress, self-hosted, wordpress
load_content_via_ajax REST route is reachable on the site.4.1.2 or later.LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load_content_via_ajax REST route, which only requires a public wp_rest nonce, to add or remove courses from any user's wishlist and determine whether a given course is wishlisted by iterating user_id and course_id values.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.