CVE-2024-6099: Thimpress Learnpress

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in the 'check_validate_fields' function in the checkout. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.

Affected products

• Thimpress Learnpress: before 4.2.6.8.2 (fixed in 4.2.6.8.2)

Published 2024-07-02. Last modified 2026-06-17.