LearnDash vulnerabilities
We track 4 vulnerabilities in LearnDash products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 14, 2026.
Latest LearnDash vulnerabilities
- 8.8 High severity
MemberDash: Authorization Bypass Through User-Controlled Key
The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the `user_account_manager()` function's edit_profile branch, where all submitted `$_POST` f
- 9.8 Critical severity
MemberDash: Authorization Bypass Through User-Controlled Key
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to
- 8.8 High severity
LearnDash LMS: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LearnDash LearnDash LMS allows SQL Injection.This issue affects LearnDash LMS: from n/a through 4.5.3.
- 8.8 High severity
LearnDash LMS: Authorization Bypass Through User-Controlled Key
The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system reso