Unauthorized File Deletion in LearnPress WordPress LMS Plugin

CVE-2025-14802

What is CVE-2025-14802?

The LearnPress LMS Plugin for WordPress is susceptible to unauthorized file deletion. This issue arises from a discrepancy between the DELETE operation and authorization checks at the /wp-json/lp/v1/material/{file_id} REST API endpoint. Authorized users, specifically those with teacher-level access, can exploit this vulnerability by sending a DELETE request with their own item_id to bypass permission checks, leading to the potential deletion of lesson materials uploaded by other educators. This vulnerability affects versions up to and including 4.3.2.2.

References