Security Alert Summary
The LearnPress – WordPress LMS Plugin contains a missing capability check in its statistic function in all versions up to and including 4.3.1. This allows unauthenticated users to access the plugin’s orders statistics, including total revenue summaries and order status counts.
CVE Details
- CVE ID:
CVE-2025-13956 - Affected component: LearnPress – WordPress LMS Plugin (statistic function in the plugin’s orders handling)
- Affected versions: All versions up to, and including, 4.3.1
- Published: December 16, 2025, 5:16 AM UTC
- Last modified: December 16, 2025, 2:10 PM UTC
- CVSS v3.1: Base Score 5.3 — MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Vector:
- Authentication / privileges / user interaction:
- Authentication required: None
- Privileges required: None
- User interaction: None
- Primary impact:
- Confidentiality: Low
- Integrity: None
- Availability: None
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
According to the CVE entry, the plugin’s statistic function lacks a capability check, which allows unauthenticated access to orders statistics. The issue is present in the plugin’s REST/API handling for orders — the referenced file path indicates the controller inc/rest-api/v1/frontend/class-lp-rest-orders-controller.php. Because the statistic endpoint does not verify whether a requester has the necessary capability, an attacker can retrieve summaries such as total revenue and order status counts without authenticating.
The vulnerability exists due to a missing authorization check on the statistic function. The reported impact is limited to disclosure of aggregated order statistics (confidentiality impact rated as Low) and does not indicate integrity or availability effects in the CVE entry.
How This Could Impact Your Website
On a site running LearnPress, an unauthenticated visitor could access order statistics that are intended for administrators or shop managers. In a typical scenario, the site owner and internal staff (e.g., course managers or finance staff) rely on order summaries to track revenue and order statuses, while external contractors or contributors do not have access to that information. With this vulnerability, an outside actor could obtain revenue summaries and order counts without logging in.
Practical consequences include increased visibility into your site’s sales performance and order trends. While the CVE describes aggregated statistics (total revenue summaries and order status counts) rather than detailed customer records, that information could still inform targeted social engineering or competitive intelligence. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE notes the issue exists in all versions up to and including 4.3.1.)
- Review and reduce unnecessary user roles, especially contributors and any roles with shop or orders access.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual requests to REST endpoints related to orders or statistics.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
