Authorization Bypass in LearnDash Plugin for WordPress
CVE-2026-12843

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Learndash Lms
Vendor
CVE Published:
5 September 2026

What is CVE-2026-12843?

The LearnDash LMS plugin for WordPress contains a flaw that allows unauthorized users to enroll any user in premium courses without proper payment verification. This vulnerability occurs due to the plugin's failure to adequately validate user permissions when executing actions. As a result, attackers can exploit this weakness to grant themselves or others access to paid educational resources without any financial transaction, undermining the integrity of the payment system.

Affected Version(s)

LearnDash LMS 4.25.0 <= 5.1.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://docs.nexcess.com/software/changelogs/learndash/sf...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Applied Cybernetics
.