CVE-2025-14802 thimpress CVE debrief

Who should care

Administrators and users of the LearnPress Plugin for WordPress should assess exposure and take necessary actions to prevent unauthorized file deletion. This includes updating to the latest version, restricting access to the vulnerable endpoint, and monitoring for suspicious activity. IT teams and security professionals responsible for WordPress installations and plugin management should prioritize this vulnerability.

Why it matters

CVE-2025-14802 is a medium-severity vulnerability in the LearnPress Plugin for WordPress that allows authenticated attackers to delete arbitrary files. Defenders should prioritize updating to the latest version and monitoring for suspicious activity.

• Authenticated attackers with teacher-level access can delete arbitrary lesson material files uploaded by other teachers
• Deletion of files can disrupt learning materials and cause data loss

Technical summary

The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v1/material/{file_id} REST API endpoint. This is due to a parameter mismatch between the DELETE operation and authorization check, where the endpoint uses file_id from the URL path but the permission callback validates item_id from the request body.

Defensive priority

Medium

Recommended defensive actions

• Review and update LearnPress Plugin to the latest version
• Restrict access to the /wp-json/lp/v1/material/{file_id} REST API endpoint
• Monitor for suspicious file deletion activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The LearnPress – WordPress LMS Plugin is vulnerable to unauthorized file deletion due to a parameter mismatch in the /wp-json/lp/v1/material/{file_id} REST API endpoint. Authenticated attackers with teacher-level access can delete arbitrary lesson material files uploaded by other teachers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.