CVE-2026-127213: LearnPress Course Wishlist < 4.1.2 IDOR via render_button

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary userid parameter to the renderbutton callback instead of relying on the session identity. Attackers can exploit the publicly accessible loadcontentviaajax REST route, which only requires a public wprest nonce, to add or remove courses from any user's wishlist and determine whether a given course is wishlisted by iterating userid and courseid values.