CVE-2026-127213
MEDIUM
MEDIUM
Priority: 0.00
BB Relevance:
74/100
Published: 2026-11-13
Modified: 2026-11-13
First seen: 2026-11-13
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
Low
VI:
Low
VA:
None
Description
LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load_content_via_ajax REST route, which only requires a public wp_rest nonce, to add or remove courses from any user's wishlist and determine whether a given course is wishlisted by iterating user_id and course_id values.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| ThimPress | LearnPress – Course Wishlist | 0 < 4.1.2 |
| ThimPress | LearnPress – Course Wishlist | 0 < 4.1.2 |
References & Advisories (2)
third-party-advisory
release-notes
patch