The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage() handler only checks the editpages capability and a wprest nonce (both available to Editors), then reads the fieldname parameter from the request without restricting it to a learnpress allow-list before passing it as the option key to LPHelper::createpage(), which calls updateoption($keyoption, $pageid). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping userscanregister to a truthy value to open public registration, corrupting activeplugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.