WordPress LMS Plugin Bypasses Authorization via AJAX Endpoint

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::render_material_items() callback exposed on the public lp-ajax-handle (load_content_via_ajax) endpoint. The endpoint is explicitly listed in the AbstractAjax no-nonce allowlist and performs no capability check, and the render_material_items() handler decides authorization against one attacker-supplied identifier (course_id) while fetching the returned material rows via a second, independently attacker-supplied identifier (item_id) with no check that the lesson belongs to the authorized course. This makes it possible for unauthenticated attackers to read and download course-material files (uploaded and external file paths/URLs) belonging to lessons in paid or enrollment-required courses, provided any single course on the site has 'No Required Enroll' enabled and owns at leas

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The LearnPress WordPress LMS plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in its AJAX handler that exposes course material to unauthorized access. By exploiting the publicly accessible lp-ajax-handle endpoint, attackers can retrieve sensitive course content without proper authentication or capability checks. This affects WordPress sites running versions up to 4.4.8 of the plugin, potentially exposing student enrollment data, course materials, and other sensitive educational content. The vulnerability's CVSS score of 7.5 reflects the significant risk posed to educational institutions and training platforms relying on this plugin.

Casky's 283 mapped security skills leverage Claude AI's extended reasoning to identify attack patterns aligned with MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would detect this vulnerability through skills that recognize: (1) missing authorization checks in web application handlers, (2) direct object reference patterns where user-supplied parameters bypass access controls, and (3) AJAX endpoint enumeration combined with capability verification failures. The platform would flag suspicious patterns such as requests to load_content_via_ajax that retrieve course materials without validating user enrollment status, and identify the no-nonce allowlist as a potential attack surface. By correlating these indicators with MITRE techniques, practitioners gain visibility into both the exploitation method and the underlying authorization weaknesses that enable privilege escalation attacks.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-93882.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-93882

Casky has 283 skills that investigate the attack patterns behind CVE-2026-93882. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn