LearnPress CVE-2026-115599

The available sources do not name the specific LearnPress endpoint, feature, or parameter whose access control is missing - the description only states that incorrectly configured access-control security levels can be exploited, so the precise trigger is not described in the available sources. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication, no user interaction, and no special non-default configuration: any internet-reachable WordPress site running LearnPress at or below 4.4.11 appears exploitable. The main limiting factor is impact scope - the flaw yields only confidentiality loss (C:H, I:N, A:N), i.e., unauthorized data disclosure rather than modification, account takeover, or site compromise.

Signals are moderate and partly incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw whose entire impact is confidentiality - no integrity or availability loss - consistent with a missing-authorization (CWE-862) data-exposure issue rather than code execution or takeover. No EPSS score, no CISA KEV listing, and no SSVC machine-readable decision were supplied, so widespread-exploitation probability cannot be quantified from the input; the only prioritization signal is the vuln.today 'this_week' decision label and the fact that it was reported by Patchstack. No verified public exploit code is present - the single reference is a Patchstack advisory database entry, not a working PoC. Net: this is a credible, easy-to-trigger unauthenticated information-disclosure bug in a widely used WordPress plugin, warranting prompt (this-week) remediation, but there is no evidence yet of active or at-scale exploitation, and its confidentiality-only impact places it below full-compromise criticals despite the 'high' severity band.

A remote, unauthenticated attacker sends crafted HTTP requests to a WordPress site running a vulnerable LearnPress plugin and reaches functionality whose authorization check is missing or misconfigured, returning data that should be restricted (e.g., course content, quiz/answer material, or user information). The CVSS vector indicates this needs no authentication, no user interaction, and low complexity, so it is scriptable at scale against exposed sites. No verified working exploit code was identified in the provided sources, though a Patchstack advisory documents the issue.