CVE-2026-75982: LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage() handler only checks the editpages capability and a wprest nonce (both available to Editors), then reads the fieldname parameter from the request without restricting it to a learnpress allow-list before passing it as the option key to LPHelper::createpage(), which calls updateoption($keyoption, $pageid). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping userscanregister to a truthy value to open public registration, corrupting activeplugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Editor-level access or higher can exploit it. The affected AJAX handler accepts the edit_pages capability and a wp_rest nonce, both of which are available to Editors.
What does an attacker need to do to exploit it?
The attacker must be logged in as an Editor or higher and invoke the learnpress_create_page AJAX action with a field_name value naming the option to alter. The resulting option value is limited to a positive integer representing a newly created page ID.
Are site-wide WordPress settings at risk?
Yes. Because field_name is not restricted to LearnPress option names, the attacker can target arbitrary WordPress options, including users_can_register or active_plugins. This can enable public registration or disrupt the site by corrupting the active plugin configuration.