CVE-2025-13956

LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts

Affected

thimpress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

CVSS v3.1 WORDFENCE

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.89% chance of exploitation in the next 30 days, 59th percentile

Nuclei

medium · CWE-862

Published

2025-12-16

Updated

2026-04-08

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13956.yaml

References

• CVE Record
• NVD entry