CVE-2025-13964

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13964", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-03T15:01:16.691Z", "datePublished": "2026-01-06T08:21:49.475Z", "dateUpdated": "2026-04-08T17:15:21.098Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:21.098Z"}, "affected": [{"vendor": "thimpress", "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LearnPress \u2013 WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the catch_lp_ajax function in all versions up to, and including, 4.3.2. This makes it possible for unauthenticated attackers to modify course contents by adding/removing/updating/re-ordering sections or modifying section items."}], "title": "LearnPress \u2013 WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae363511-8a1f-476a-9851-61f7763428c2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.1/inc/Ajax/EditCurriculumAjax.php#L52"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.1/inc/Ajax/AbstractAjax.php#L18"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "timeline": [{"time": "2025-11-25T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-03T15:17:19.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-05T19:55:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T14:28:31.158518Z", "id": "CVE-2025-13964", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:28:43.754Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13964", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T14:28:31.158518Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:28:37.776Z"}}], "cna": {"title": "LearnPress \u2013 WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification", "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "thimpress", "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.3.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-25T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-12-03T15:17:19.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-05T19:55:08.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae363511-8a1f-476a-9851-61f7763428c2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.1/inc/Ajax/EditCurriculumAjax.php#L52"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.1/inc/Ajax/AbstractAjax.php#L18"}], "descriptions": [{"lang": "en", "value": "The LearnPress \u2013 WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the catch_lp_ajax function in all versions up to, and including, 4.3.2. This makes it possible for unauthenticated attackers to modify course contents by adding/removing/updating/re-ordering sections or modifying section items."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:21.098Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13964", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:15:21.098Z", "dateReserved": "2025-12-03T15:01:16.691Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-06T08:21:49.475Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses", "vendor": "thimpress", "versions": [{"lessThanOrEqual": "4.3.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LearnPress \u2013 WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the catch_lp_ajax function in all versions up to, and including, 4.3.2. This makes it possible for unauthenticated attackers to modify course contents by adding/removing/updating/re-ordering sections or modifying section items."}, {"lang": "es", "value": "El plugin LearnPress \u2013 WordPress LMS Plugin para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una verificaci\u00f3n de capacidad faltante en la funci\u00f3n catch_lp_ajax en todas las versiones hasta, e incluyendo, la 4.3.2. Esto hace posible que atacantes no autenticados modifiquen los contenidos del curso al a\u00f1adir/eliminar/actualizar/reordenar secciones o modificar elementos de secci\u00f3n."}], "id": "CVE-2025-13964", "lastModified": "2026-06-17T08:35:03.630", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13964", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:28:31.158518Z", "version": "2.0.3"}}]}, "published": "2026-01-06T09:15:54.513", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.1/inc/Ajax/AbstractAjax.php#L18"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.1/inc/Ajax/EditCurriculumAjax.php#L52"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae363511-8a1f-476a-9851-61f7763428c2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:49:55.839543+00:00", "value": {"mitigation_remediation": ["Upgrade the LearnPress plugin to version 4.3.3 or later, which removes the missing capability check.", "If an immediate upgrade is not possible, disable the LearnPress Ajax endpoint by removing or hard\u2011coding access rules to prevent unauthenticated requests.", "Configure web\u2011application firewalls or server\u2011level access controls to block external access to the admin\u2011ajax.php URL used by LearnPress, limiting traffic to authenticated users only."], "summary": {"action": "Apply Patch", "impact": "Unauthenticated modification of course content"}, "threat_synthesis": {"affected_systems": "This vulnerability impacts the LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses. All releases numbered up to and including version 4.3.2 are affected. Users running these versions should verify their plugin version and apply any updates as soon as they become available.", "description_and_impact": "The LearnPress \u2013 WordPress LMS Plugin for WordPress is affected by a missing capability check inside the catch_lp_ajax function in all releases up to and including 4.3.2. Because the function does not verify that the caller has the appropriate permissions, an attacker who has no authentication can send requests to the Ajax endpoint and perform a range of modifications to a course. These changes include adding, removing, updating, or re\u2011ordering sections and section items. The flaw allows an unauthenticated attacker to alter course data.", "risk_and_exploitability": "With a CVSS score of 5.3, the vulnerability is classified as moderate severity. The EPSS score of less than 1% indicates a very low but non\u2011zero probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is exploitation of the Ajax endpoint without any authentication, allowing the attacker to directly send crafted requests to modify course data."}}}}, "created": "2026-01-06T14:15:49.564097+00:00", "updated": "2026-04-21T17:00:12.309068+00:00", "vendors": ["thimpress", "thimpress$PRODUCT$learnpress", "wordpress", "wordpress$PRODUCT$wordpress"]}