CVE-2026-7648: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to payment bypass through user-controlled key in all versions up to, and including, 4.3.5. This is due to improper handling of user-supplied request parameters in the REST API endpoint, which passes the unsanitized parameter array to the addtocart() function where arraymerge() allows attacker-controlled values to overwrite hardcoded defaults. This makes it possible for authenticated attackers, with subscriber-level access and above, to enroll in any paid course entirely free of charge by supplying a quantity value of zero, which causes the order total to calculate as $0 and bypasses all payment gateway requirements.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LearnPress – WordPress LMS Plugin for Create and Sell Online Coursesto a version that resolves this vulnerability.Fixed in 4.3.5 - Compensating control
Apply an interim mitigation for the REST API payment bypass by preventing authenticated subscribers+ from enrolling free via a user-controlled 'quantity' parameter (e.g., validate/sanitize the 'quantity' request parameter so quantity=0 cannot be used to reduce order totals to $0, and ensure payment gateway requirements cannot be bypassed through overridden cart parameters).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7648?
CVE-2026-7648 is classified as a medium severity vulnerability due to its potential impact on course enrollment through payment bypass.
How do I fix CVE-2026-7648?
To fix CVE-2026-7648, update the LearnPress plugin to version 4.3.6 or later, which addresses the payment bypass issue.
What types of users are affected by CVE-2026-7648?
CVE-2026-7648 affects authenticated users with Subscriber or higher roles who have access to the plugin's functionalities.
What is the nature of the vulnerability in CVE-2026-7648?
CVE-2026-7648 involves an authenticated payment bypass vulnerability that allows users to enroll in courses for free by manipulating the 'quantity' parameter.
Can CVE-2026-7648 be exploited remotely?
CVE-2026-7648 cannot be exploited remotely as it requires user authentication to exploit the payment bypass mechanism.