CVE-2025-11368

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.

• CWE-200

• https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/frontend/class-lp-rest-ajax-controller.php#L23
• https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/rest-api/v1/frontend/class-lp-rest-ajax-controller.php#L41
• https://plugins.trac.wordpress.org/changeset?old_path=/learnpress/tags/4.2.9.4&new_path=/learnpress/tags/4.3.0&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0c9856db-3779-4649-9a48-1c7b6d019816?source=cve

Published

Nov 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11361The Gutenberg Essential Blocks – Page Builder for Gutenberg …6.4
• CVE-2025-11362Versions of the package pdfmake from 0.3.0-beta.1 and before…8.7
• CVE-2025-11363The Royal Addons for Elementor WordPress plugin before 1.7.…5.3
• CVE-2025-11365The WP Google Map Plugin plugin for WordPress is vulnerable …6.5
• CVE-2025-11366N-central < 2025.4 is vulnerable to authentication bypass vi…9.8
• CVE-2025-11367The N-central Software Probe < 2025.4 is vulnerable to Remot…9.8
• CVE-2025-11369The Gutenberg Essential Blocks – Page Builder for Gutenberg …4.3
• CVE-2025-1137IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configu…8.8
• CVE-2025-11370The Popup and Slider Builder by Depicter – Add Email collect…5.3
• CVE-2025-11371In the default installation and configuration of Gladinet Ce…7.5
• CVE-2025-11372The LearnPress – WordPress LMS Plugin plugin for WordPress i…6.5
• CVE-2025-11373The Popup and Slider Builder by Depicter – Add Email collect…4.3