Unauthorized Data Access Vulnerability in LearnPress WordPress LMS Plugin

CVE-2025-13956

What is CVE-2025-13956?

The LearnPress plugin for WordPress contains a vulnerability that allows unauthorized users to access sensitive order statistics. This security issue is due to a missing capability check on the statistics function, enabling unauthenticated attackers to retrieve total revenue summaries and order status counts. As a result, any user could view critical economic data associated with LearnPress without needing proper authentication. This exposure emphasizes the importance of implementing robust access controls within plugins to safeguard against unauthorized data access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References