ThimPress

CVE-2026-127213: LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's

CVE-2026-127213 Nov 13, 2026 Source: Vendor

In brief. ThimPress published CVE-2026-127213: LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's on November 13, 2026. It credits 2 researchers and teams for 1 CVE.

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load_content_via_ajax REST route, which only requires a public wp_rest nonce, to add or remove courses from any user's wishlist and determine whether a given co

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-127213

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

2 lines

Showing 1–2 of 2

CVE-2026-127213 BR2026-0000-049096 unclaimed

Credited as xuannthanh

CVE-2026-127213 BR2026-0000-049097 unclaimed

Credited as buiih