CVE-2026-11988: The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure

The LearnPress WordPress plugin (versions up to 4.3.9.1) has a security flaw called IDOR (insecure direct object reference, where attackers bypass checks meant to prevent accessing other users' data) in the 'userId' parameter. An authenticated user with subscriber-level access or higher can view course enrollment and completion information belonging to teacher or administrator accounts by exploiting missing validation checks.