LearnPress WordPress LMS Plugin - Information Disclosure (CVE-2025-11368)

CVE-2025-11368 is an information disclosure vulnerability in the LearnPress – WordPress LMS Plugin up to version 4.2.9.4, caused by missing capability checks in a REST API endpoint. This flaw allows unauthenticated attackers to access sensitive admin-only educational content, including curriculum HTML, quiz questions with correct answers, and course materials, simply by supplying valid numeric IDs. Attackers could exploit this vulnerability to gain unauthorized insights into course content and assessments, potentially undermining the integrity of online learning environments.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2025-11368 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. CrowdSec network telemetry also shows that exploitation of CVE-2025-11368 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the /wp-json/lp/v1/load_content_via_ajax REST API endpoint by sending crafted POST requests with arbitrary callback parameters, allowing them to retrieve sensitive admin-level educational content such as curriculum HTML, quiz answers, and course materials without authentication.