LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter

Summary

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to payment bypass through user-controlled key in all versions up to, and including, 4.3.5. This is due to improper handling of user-supplied request parameters in the REST API endpoint, which passes the unsanitized parameter array to the add_to_cart() function where array_merge() allows attacker-controlled values to overwrite hardcoded defaults. This makes it possible for authenticated attackers, with subscriber-level access and above, to enroll in any paid course entirely free of charge by supplying a quantity value of zero, which causes the order total to calculate as $0 and bypasses all payment gateway requirements.

Timeline

1. May 14, 2026, 3:27 AM UTCCVE published
2. May 14, 2026, 10:39 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. May 14, 2026, 10:47 AM UTCRecord last updated

Affected versions

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

  through 4.3.5

References 8