THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-12843 (MEDIUM 5.4) — The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users

[NVD] CVE-2026-12843 (MEDIUM 5.4) — The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users

mednvdPublished 2026-09-05

CVE-2026-12843 CVSS: 5.4 MEDIUM Published: 2026-09-05T12:16:46.923

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypas

Indicators of compromise

CVE-2026-12843cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-12843