Unauthorized Data Access Vulnerability in LearnPress WordPress LMS Plugin

CVE-2025-13956

What is CVE-2025-13956?

The LearnPress plugin for WordPress contains a vulnerability that allows unauthorized users to access sensitive order statistics. This security issue is due to a missing capability check on the statistics function, enabling unauthenticated attackers to retrieve total revenue summaries and order status counts. As a result, any user could view critical economic data associated with LearnPress without needing proper authentication. This exposure emphasizes the importance of implementing robust access controls within plugins to safeguard against unauthorized data access.

References