ThimPress LearnPress CVE-2026-110363

Requires an authenticated session on the target WordPress site running LearnPress ≤ 4.4.10 - per PR:L, at least a low-privilege account (such as a self-registered student/subscriber), which is common on LMS deployments that enable open enrollment. Exploitation is network-based with no victim user interaction needed (UI:N) and low complexity (AC:L). Limiting factors: sites that disable public registration and have no low-privilege users meaningfully raise the barrier, and impact is confined to partial confidentiality/integrity of LearnPress-managed data (C:L/I:L, A:N) rather than full site takeover. The exact protected action/endpoint lacking the authorization check is not specified in the available data.

This is a medium-severity (CVSS 5.4) Missing Authorization / Broken Access Control flaw (CWE-862) in the LearnPress WordPress LMS plugin. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network-reachable exploitation at low attack complexity requiring some authentication (PR:L) - consistent with a logged-in low-privilege account such as a student/subscriber, which LearnPress sites typically allow via open registration. Impact is partial confidentiality and integrity with no availability effect, reflecting unauthorized access to or modification of data rather than full compromise. No EPSS score, CISA KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a real-but-moderate priority rather than an emergency. No SSVC decision data was provided. The main risk amplifier is the plugin's popularity and the fact that LearnPress sites commonly permit self-registration, lowering the practical barrier implied by PR:L. Signals are internally consistent - nothing in the description contradicts the CVSS vector - though the exact protected resource (which endpoint/action is missing the capability check) is not detailed in the available data.

An attacker registers or uses an existing low-privilege account (e.g. student) on a WordPress site running LearnPress 4.4.10 or earlier, then invokes a plugin action or endpoint that fails to enforce proper authorization, letting them read or alter data they should not reach. No public exploit code was identified in the input, and no user interaction by a victim is required.