CVE-2025-13964: 
WordPress vulnerability analysis and mitigation

CVE-2025-13964 is a missing authorization vulnerability in the LearnPress – WordPress LMS Plugin that allows unauthenticated attackers to modify course content. The flaw affects all versions of the plugin up to and including 4.3.2, and was disclosed on January 6, 2026, with Wordfence as the reporting CNA. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, NVD).

The vulnerability is classified as CWE-862 (Missing Authorization) and stems from the absence of a capability check on the catch_lp_ajax function within the plugin's AJAX handling layer. Specifically, the AbstractAjax.php and EditCurriculumAjax.php files fail to verify whether the requesting user has appropriate permissions before processing course modification requests. Because WordPress AJAX endpoints are network-accessible without authentication by default, any unauthenticated remote attacker can send crafted AJAX requests to add, remove, update, or reorder course sections and their items (Wordfence, NVD).

Successful exploitation allows unauthenticated attackers to arbitrarily modify the structure and content of any course managed by the LearnPress plugin, including adding, removing, reordering, or updating sections and section items. This poses a significant integrity risk to e-learning platforms, potentially disrupting course delivery, corrupting curriculum data, and undermining trust in the affected WordPress site. There is no confidentiality or availability impact identified, and lateral movement beyond the WordPress course content is not directly enabled by this vulnerability (Wordfence).

1. Reconnaissance: Identify WordPress sites running LearnPress plugin versions ≤ 4.3.2 using tools like WPScan, Shodan, or by inspecting plugin version metadata in publicly accessible WordPress files (e.g., /wp-content/plugins/learnpress/readme.txt).
2. Identify the vulnerable AJAX endpoint: Locate the WordPress AJAX handler at /wp-admin/admin-ajax.php, which processes requests routed through the catch_lp_ajax function.
3. Craft a malicious AJAX request: Construct an unauthenticated HTTP POST request targeting the AJAX endpoint with the appropriate action parameter that maps to a course modification function (e.g., adding, removing, or reordering a section), without supplying any authentication credentials or nonce.
4. Submit the request: Send the crafted request to the target site. Because no capability check is performed, the server processes the modification and alters the course content as specified.
5. Verify impact: Confirm the unauthorized modification by browsing the affected course on the site or via the LearnPress admin interface (Wordfence).

• Network: Unexpected or repeated unauthenticated POST requests to /wp-admin/admin-ajax.php with AJAX action parameters related to LearnPress curriculum editing (e.g., actions involving section creation, deletion, or reordering) from unknown or suspicious IP addresses.
• Logs: WordPress access logs showing high-frequency or anomalous requests to admin-ajax.php without associated authenticated session cookies; entries lacking valid nonce values in LearnPress AJAX calls.
• Application: Unexplained changes to course structure in the LearnPress admin panel — sections added, removed, reordered, or items modified without corresponding administrator activity.

Users should update the LearnPress – WordPress LMS Plugin to version 4.3.3 or later, which addresses the missing capability check on the catch_lp_ajax function. No official configuration-based workaround has been published; upgrading is the recommended and primary remediation. Site administrators should also review course content for unauthorized modifications following the patch (Wordfence, Sucuri Blog).

Sucuri included CVE-2025-13964 in its January 2026 vulnerability patch roundup, highlighting it as one of several WordPress plugin issues requiring prompt attention (Sucuri Blog). Wordfence, as the reporting CNA, published the initial advisory and technical details. Community discussion has been limited given the medium severity rating and lack of active exploitation.