Data Modification Vulnerability in LearnPress WordPress LMS Plugin

CVE-2025-11372

What is CVE-2025-11372?

The LearnPress plugin for WordPress is susceptible to a data modification vulnerability affecting all versions up to 4.2.9.2. This issue arises from insufficient capability checks on Admin Tools REST endpoints, which are misconfigured with a permission callback that allows unrestricted access (“__return_true”). Consequently, attackers without authentication can execute harmful database operations using the '/wp-json/lp/v1/admin/tools/create-indexs' endpoint, including dropping indexes on crucial tables like 'wp_options', duplicating configuration entries, or impairing site performance by targeting other database tables through valid table names.

References