LearnDash Penetration Testing
LearnDash decides course access, group roles and paid enrolment through its own settings, not WordPress defaults. We test whether those settings hold when content, quizzes or the API are requested directly. CREST-certified testers, fixed price from £2,060 for a 2-day single-site scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
LearnDash gates courses, quizzes, groups and payment access through its own settings layered on top of WordPress. We test which of those settings are actually enforced on the site you run, not just the ones documented as defaults.
Why LearnDash security comes down to its own settings
LearnDash gates every course through one of five settings, Open, Free, Buy Now, Recurring or Closed, and each one decides whether a lesson or topic is served to a visitor before payment or login are checked. We test whether that check happens on the request for the content itself, not only on the Take This Course button, and whether a locked lesson or topic can be reached directly once its URL or post ID is known.
Group Leaders sit between learners and administrators, and LearnDash’s own Group Leader capability settings let a site owner grant Basic or Advanced WordPress capabilities such as edit_others_groups, list_users and create_users. We test whether a Group Leader account can reach users, courses or groups outside the ones they were assigned to, and whether the Advanced capabilities were switched on further than the business intended.
Buy Now and Recurring courses hand off to PayPal, Stripe or Razorpay before LearnDash marks a user enrolled, and the REST API exposes courses, users and progress across three namespaces protected by the same WordPress capability model. We test whether enrolment is only granted once the gateway has genuinely confirmed payment, and whether an authenticated low-privilege account can reach another user’s course or quiz data through the API rather than the browser.
SCOPE
What we pen test on a LearnDash site
Course and Lesson Access Enforcement
Every course sits behind an enrolment mode, Open, Free, Buy Now, Recurring or Closed, and each one decides whether a lesson or topic serves its content before login or payment are checked. We test whether a locked lesson or topic can still be reached by requesting its URL or post ID directly, rather than only checking the course menu.
Course Prerequisite and Progression Bypass
Course Prerequisites can require any one selected course or all of them before a learner reaches the next, and Linear Progression can lock a lesson until the one before it is marked complete. We test whether that ordering is enforced when a step is requested out of sequence, not only when a learner clicks through in order.
Learner, Group Leader and Administrator Boundaries
Group Leaders can be granted Basic or Advanced WordPress capabilities, from managing their own group’s users to creating, listing or deleting any user on the site. We test whether a Group Leader account can reach users, courses or groups beyond the ones they were actually assigned to lead.
Payment Gateway Callback Integrity
Buy Now and Recurring courses hand off to PayPal, Stripe or Razorpay, and LearnDash enrols a learner once the gateway confirms a successful payment. We test whether that confirmation is verified server-side rather than trusted from a browser redirect, and whether a cancelled or failed recurring payment still leaves course access open.
REST API Endpoint Authorisation
LearnDash exposes courses, users, groups and progress data across its ldlms/v1, ldlms/v2 and learndash/v1 REST namespaces, authenticated with the same WordPress cookie and nonce a logged-in session uses. We test every endpoint in scope against the role that is actually calling it, not the role the front end assumes is calling it.
Quiz Question and Answer Exposure
Correct answers are stored against each quiz question in the quiz builder, and a learner’s own result shows which answers they got right after submitting. We test whether that answer data can be reached before submission, or by a role that should only see a pass or fail, through the API, page source or a cached response.
Assignment Upload and Download Boundaries
Assignments let a learner upload files to a Lesson or Topic for an instructor or Group Leader to download, comment on and approve. We test whether an uploaded file can be reached by a user other than its owner or the staff assigned to grade it, including by requesting the file’s direct URL.
Essay Submission and Grading Integrity
Each submitted essay becomes its own page in the Submitted Essays screen, with a permalink, comments and a points value an instructor sets before the quiz status moves out of Not Graded. We test whether that page and its comments are restricted to the learner and grading staff, and whether the points a learner receives can be replayed or altered from their own account.
Connected Plugin Boundaries: Membership and WooCommerce
Closed courses hand enrolment to a membership plugin or WooCommerce, granting or revoking course access outside LearnDash’s own payment settings. We test that handoff for gaps such as an order status that grants access before payment clears, or a membership that lapses without LearnDash actually revoking the course.
Certificates and Multi-Platform LMS Data
Certificates can be awarded on course completion or on passing a quiz, and we test whether one can be generated or downloaded before that condition is genuinely met, or for a course the requesting account was never enrolled in. Where an organisation runs some courses on Moodle alongside LearnDash, our Moodle penetration testing covers the equivalent completion and gradebook surface.
OUR PROCESS
LearnDash Penetration Testing: From Scope to Attestation
Scope and Access
We agree which courses, groups and payment gateways are in scope, plus test accounts for a learner, a Group Leader and an administrator.
Access Mode and Capability Mapping
We map every course’s enrolment mode and prerequisites against the Group Leader and administrator capabilities configured on the site, so we know which boundary each test needs to cross.
Manual Testing
A CREST-certified tester manually tests course and lesson access, quiz and assignment data, REST API endpoints and the payment enrolment flow, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST LearnDash pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent LearnDash Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test LearnDash For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From LearnDash Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our LearnDash site?
We need a learner account, a Group Leader account and an administrator account, each enrolled in the courses and groups you want tested. If Buy Now or Recurring courses are in scope, a way to complete a real or sandboxed payment with your chosen gateway speeds up testing of the enrolment flow.
Will testing touch our live learner data?
We test whichever environment you give us access to. If that is production, we agree exclusions upfront, such as sending real certificates or emails to learners, and we do not submit real assignments, essays or payments against live accounts without that agreement in writing.
How long does a LearnDash penetration test take?
A single LearnDash site sits in our 2-day single-site scope, with a report typically landing around 5 working days after kickoff. Sites with several connected plugins, multiple payment gateways or a large group structure move into a wider scope with more testing days.
Do you test LearnDash Cloud as well as a self-hosted site?
Yes, though the scope differs. A self-hosted LearnDash site is tested end to end, including server-side access checks on your own hosting; LearnDash Cloud is a fully hosted WordPress platform, so we test the course, group and API configuration you control within it rather than the hosting infrastructure LearnDash Cloud itself runs on.
What is out of scope for a single-site LearnDash test?
Infrastructure-level issues in the underlying WordPress hosting, server or network are out of scope for this test and covered by our cloud penetration testing service instead. A payment gateway’s own platform, such as PayPal or Stripe, is also out of scope; we test how your site integrates with it, not the gateway itself.
Do you need our source code or plugin list?
No. Testing is black-box against the running site by default. Telling us which add-ons, membership plugins or WooCommerce integrations are active in advance helps us scope realistic test accounts, and a grey-box option covering specific custom code is available if you want deeper coverage.
Does LearnDash have a customer penetration-testing policy we need to follow?
No. LearnDash is a plugin installed on your own WordPress site, not a shared multi-tenant service, so there is no vendor notification process to follow before testing your installation. If you run LearnDash Cloud or a managed WordPress host, that provider’s own testing policy applies and we confirm it during scoping.
Can you test quizzes, assignments and certificates without disrupting real learners?
Yes. We use the test accounts you provide to attempt quizzes, submit assignments and essays, and check certificate issuance, so real learner submissions and grades are not touched unless you specifically ask us to test against production data under agreed exclusions.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your LearnDash site
LearnDash decides course access, group roles and paid enrolment through its own settings, not WordPress defaults. We test whether those settings hold when content, quizzes or the API are requested directly. CREST-certified testers, fixed price from £2,060 for a 2-day single-site scope, quoted within 24 hours.
