Access violation vulnerability in LearnPress – WordPress LMS Plugin 4.3.2.1

A popular plugin for WordPress called LearnPress has a security issue that allows unauthorized users to delete files. This affects versions up to 4.3.2.2 and can be done through a specific part of the plugin called the “REST API endpoint”. This happens because there is a mistake in how the plugin checks for permission to delete files. This means that someone who is logged in and has teacher-level access can delete any file uploaded by other teachers. They can do this by making a special request and using their own identification number while targeting someone else’s file.