LearnPress CVE-2026-107744

Requires an authenticated WordPress account at subscriber level or above (per PR:L), so exploitation is gated by having or obtaining such an account - trivial on sites that permit open user/registration (common for a course-selling LMS) and substantially harder where registration is disabled. The site must be running LearnPress 4.4.10 or earlier. Beyond holding a low-privilege account there is no other special configuration prerequisite and no user interaction is needed; the attacker abuses the plugin's user-search handling, which fails to verify authorization and reflects enough signal to act as a per-character oracle against the user_login and user_email columns.

This is a genuine but bounded information-disclosure issue rather than a critical-priority flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 Medium) is internally consistent with the description: network-reachable, low complexity, requires low privileges (PR:L corresponds to the stated subscriber-level account), no user interaction, and a pure confidentiality impact (C:H, I:N, A:N) with no integrity or availability effect. The C:H rating is justified because the oracle technique can harvest the complete user roster and the full email of every account, including administrators, which is prime material for targeted phishing and credential-stuffing follow-on attacks. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT on CISA KEV and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The key moderating factor is the authentication requirement: an attacker needs at least a subscriber account, which on sites that disable open registration meaningfully raises the bar, but on the many WordPress/LearnPress sites that permit self-registration (common for a course-selling LMS) that bar is trivial. Net: a real, worth-patching confidentiality flaw useful primarily as reconnaissance, but not an emergency given the authentication prerequisite and absence of any exploitation or POC signal.

An attacker self-registers (or uses an existing low-privilege subscriber account) on a LearnPress-powered site, then issues crafted user-search requests whose responses behave as a true/false oracle against the user_login and user_email columns. By varying the search string character-by-character, the attacker reconstructs the full email addresses of all accounts - including administrators - for use in subsequent spear-phishing or password attacks. No public exploit code is referenced, so the technique would need to be reproduced from the description and the linked source code.