# CVE-2025-11368: LearnPress WordPress LMS Plugin - Information Disclosure

> Live exploitation tracking for CVE-2025-11368 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-11368

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** ThimPress LearnPress WordPress LMS Plugin
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** wordpress, cms

## Description

The LearnPress WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.

## CrowdSec analysis

[CVE-2025-11368](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-11368) is an information disclosure vulnerability in the LearnPress – WordPress LMS Plugin up to version 4.2.9.4, caused by missing capability checks in a REST API endpoint. This flaw allows unauthenticated attackers to access sensitive admin-only educational content, including curriculum HTML, quiz questions with correct answers, and course materials, simply by supplying valid numeric IDs. Attackers could exploit this vulnerability to gain unauthorized insights into course content and assessments, potentially undermining the integrity of online learning environments.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2025-11368 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
CrowdSec network telemetry also shows that exploitation of CVE-2025-11368 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the `/wp-json/lp/v1/load_content_via_ajax` REST API endpoint by sending crafted POST requests with arbitrary callback parameters, allowing them to retrieve sensitive admin-level educational content such as curriculum HTML, quiz answers, and course materials without authentication.

## Timeline

- 2025-11-21: CVE Published. CVE-2025-11368 is published to NVD.
- 2026-03-30: Rule Released. CrowdSec releases a rule to detect CVE-2025-11368 exploitation attempts against the CrowdSec Network.
- 2026-03-31: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-11368 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11368.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-11368) follows observed exploitation activity for CVE-2025-11368. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.