CVE-2025-13956

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.91% chance of exploitation in the next 30 days, 57th percentile

Nuclei

medium · CWE-862

Published

2025-12-16

Updated

2026-04-08

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-13956.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2025-13949
• CVE-2025-13958
• CVE-2025-13948
• CVE-2025-14004
• CVE-2025-13929
• CVE-2025-14005