Insecure Direct Object Reference in LearnPress Course Wishlist Add-on by WordPress

CVE-2026-127213

What is CVE-2026-127213?

The LearnPress Course Wishlist Add-on prior to version 4.1.2 is affected by an insecure direct object reference vulnerability, allowing remote attackers to manipulate users' course wishlists. By supplying an arbitrary user_id parameter to the render_button callback, attackers can exploit the publicly available load_content_via_ajax REST route. This exploitation enables them to add or remove courses from any user's wishlist and determine if specific courses are wishlisted by iterating through user_id and course_id values, bypassing session identity checks.

References