CVE-2023-36515 is a high severity (7.3) missing authorization flaw in the ThimPress LearnPress WordPress plugin, versions through 4.2.3. Patchstack describes it as unauthenticated broken access control. Update to a release newer than 4.2.3, and read the plugin changelog to confirm the fix.
What's affected
The record says ThimPress LearnPress is affected in versions from n/a through 4.2.3, which means every release up to and including 4.2.3.
The record gives no fixed version. Its reference is a Patchstack entry titled as an unauthenticated broken access control vulnerability in LearnPress 4.2.3. The page refused an automated request, so I could not read it, and I cannot name the first fixed release. Check the plugin's changelog in the WordPress directory for the first version after 4.2.3 that mentions access control.
LearnPress runs course sites and learning portals, which often hold student accounts and payment links. That raises the stakes for even a low impact access control bug.
How to check if you're exposed
WP-CLI gives the version quickly on any site where you have shell access.
wp plugin list --fields=name,status,version,update
wp plugin get learnpress --field=version
Without shell access, open Plugins in the WordPress admin and read the version under LearnPress. 4.2.3 and below is affected.
LearnPress also has add ons, such as payment gateways and course extensions, which are separate plugins with their own versions. Update them together with the core plugin and test a purchase and an enrolment afterwards.
If you host sites for others, check client learning portals first. They are often set up once and left alone.
What to do now
- Find every site with LearnPress installed, including staging copies.
- Update LearnPress and its add ons to the newest releases, test enrolment and checkout, and read the changelog for access control fixes.
- Review user accounts and course content for changes you did not make.
- Check web server logs for unusual requests to the plugin's endpoints around your update window.
- Turn on automatic updates for the plugin, or put it on a monthly review.
- Keep backups of the site and database so you can restore if something was altered.
Why it matters
The weakness is CWE-862, missing authorization. The plugin handles a request without checking that the caller is allowed to make it. Patchstack's entry title says it is reachable without logging in, and the record's vector agrees, with no privileges and no user interaction needed.
The score is 7.3, with low impact on confidentiality, integrity and availability. The scoring suggests the flaw lets an outsider perform limited actions, not take over the site. The record does not say what those actions are, so avoid assuming more than that. It is not on CISA's Known Exploited Vulnerabilities list, and I found no claim of exploitation.
Learning platforms carry a lot of personal data and often take payments. An authorization gap in a plugin like this can be a first step for someone probing a site. Fixing it is simple. Update, then check.
Try it yourself
When a fixed release exists, how fast can you get it into place? This demo shows how a fix-available flag guides the update.
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need to log in?
The record's vector says no privileges are needed, and Patchstack's entry title calls it unauthenticated.
Which release fixes it?
The record does not say. Update past 4.2.3 and check the changelog, since I could not open the Patchstack entry.
Sources
- Patchstack entry for LearnPress (cited by the record; blocked to automated fetch)
- Safeguard Gold entry for CVE-2023-36515
Last reviewed: 19 October 2026.
