Esta página aún no ha sido traducida a tu idioma. Mostrando contenido en inglés mientras trabajamos en ello.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-7648: Payment Bypass in LearnPress WordPress LMS
Plataforma
wordpress
Componente
learnpress
Corregido en
4.3.6
CVE-2026-7648 is a payment bypass vulnerability discovered in the LearnPress WordPress LMS plugin. This flaw allows authenticated attackers, even those with subscriber-level access, to enroll in paid courses without charge. The vulnerability affects versions 0.0.0 through 4.3.5 of the plugin and has been resolved in version 4.3.6.
Detecta esta CVE en tu proyecto
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Impacto y Escenarios de Ataquetraduciendo…
The primary impact of CVE-2026-7648 is the ability for attackers to gain free access to paid courses within a LearnPress-powered WordPress site. This can result in significant revenue loss for course creators and platform owners. An attacker could systematically enroll in all paid courses, potentially disrupting the platform's business model. While requiring authentication (subscriber level or higher), the relatively low access threshold expands the potential attack surface. This vulnerability shares similarities with other API parameter manipulation flaws where unsanitized input leads to unintended function behavior.
Contexto de Explotacióntraduciendo…
CVE-2026-7648 was published on 2026-05-14. Its severity is currently assessed as medium. No public exploits or proof-of-concept code have been publicly disclosed at the time of writing. It is not currently listed on KEV or EPSS, indicating a low to medium probability of active exploitation. Monitor WordPress security forums and vulnerability databases for any updates.
Inteligencia de Amenazas
Estado del Exploit
CISA SSVC
Vector CVSS
¿Qué significan estas métricas?
- Attack Vector
- Red — explotable remotamente por internet. Sin acceso físico ni local. Mayor superficie de ataque.
- Attack Complexity
- Baja — sin condiciones especiales. El atacante puede explotar de forma confiable sin configuraciones raras.
- Privileges Required
- Bajo — cualquier cuenta de usuario válida es suficiente.
- User Interaction
- Ninguna — el ataque es automático y silencioso. La víctima no hace nada.
- Scope
- Sin cambio — el impacto se limita al componente vulnerable.
- Confidentiality
- Ninguno — sin impacto en confidencialidad.
- Integrity
- Bajo — el atacante puede modificar algunos datos con alcance limitado.
- Availability
- Ninguno — sin impacto en disponibilidad.
Software Afectado
Clasificación de Debilidad (CWE)
Cronología
- Reservado
- Publicada
Mitigación y Workaroundstraduciendo…
The primary mitigation for CVE-2026-7648 is to immediately upgrade the LearnPress plugin to version 4.3.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the vulnerable REST API endpoint. WordPress firewall (WAF) rules could be implemented to filter requests containing suspicious parameters in the addtocart() function. Regularly review user roles and permissions to ensure the principle of least privilege is enforced, limiting the potential impact of compromised subscriber accounts. After upgrading, confirm the fix by attempting to enroll in a paid course with a subscriber-level user account and verifying that payment is required.
Cómo corregirlo
Actualizar a la versión 4.3.6, o una versión parcheada más reciente
Preguntas frecuentestraduciendo…
What is CVE-2026-7648 — Payment Bypass in LearnPress WordPress LMS?
CVE-2026-7648 is a medium severity vulnerability in LearnPress WordPress LMS versions 0.0.0–4.3.5 that allows authenticated attackers to bypass payment and enroll in paid courses for free due to improper handling of request parameters.
Am I affected by CVE-2026-7648 in LearnPress WordPress LMS?
Yes, if your WordPress site uses the LearnPress plugin and is running version 4.3.5 or earlier, you are affected by this vulnerability. Upgrade to version 4.3.6 to mitigate the risk.
How do I fix CVE-2026-7648 in LearnPress WordPress LMS?
The recommended fix is to upgrade the LearnPress plugin to version 4.3.6 or later. If immediate upgrade is not possible, consider temporary restrictions on the vulnerable API endpoint.
Is CVE-2026-7648 being actively exploited?
Currently, there are no publicly disclosed exploits or active campaigns targeting CVE-2026-7648. However, it's crucial to apply the patch promptly to prevent potential future exploitation.
Where can I find the official LearnPress advisory for CVE-2026-7648?
Refer to the official LearnPress plugin website and WordPress security announcements for the latest information and advisory regarding CVE-2026-7648: [https://www.learnpress.com/](https://www.learnpress.com/)
¿Tu proyecto está afectado?
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Detecta esta CVE en tu proyecto
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Escanea tu proyecto WordPress ahora — sin cuenta
Sube cualquier manifiesto (composer.lock, package-lock.json, lista de plugins WordPress…) o pega tu lista de componentes. Recibís un reporte de vulnerabilidades al instante. Subir un archivo es solo el primer paso: con una cuenta tenés monitoreo continuo, alertas en tu canal, multi-proyecto y reportes white-label.
Arrastra y suelta tu archivo de dependencias
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...