Skip to main content

LearnPress CVE-2026-12976

| EUVDEUVD-2026-57072 MEDIUM
Information Exposure (CWE-200)
2026-08-12 WPScan GHSA-3cx5-39h2-fchh
Information Disclosure WordPress Learnpress
6.5
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
6.5 MEDIUM

Network-exploitable with only a subscriber-level authenticated account (PR:L); no complexity barriers; impact is confidentiality-only as lesson content is read but cannot be altered.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Generated
Aug 12, 2026 - 20:56 vuln.today
CVSS changed
Aug 12, 2026 - 20:22 NVD
6.5 (MEDIUM)
Patch available
Aug 12, 2026 - 07:16 EUVD
CVE Published
Aug 12, 2026 - 06:00 cve.org
MEDIUM 6.5
CVE Published
Aug 12, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.

AnalysisAI

Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authenticated user - including low-privilege subscribers - to retrieve lesson material from courses they have not purchased or enrolled in. The flaw resides in the plugin's AI-assistant feature, which processes lesson content requests without first verifying the requesting user's enrollment status, exposing an authorization bypass at the content-serving layer. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated WordPress session at subscriber level or higher - any registered user account is sufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the risk: network-exploitable, low complexity, requiring only a basic authenticated WordPress session, with high confidentiality impact and no integrity or availability component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary remediation is to upgrade LearnPress to version 4.4.4 or later, which introduces proper enrollment verification prior to processing AI-assistant content requests; the vendor-released patch is confirmed available and documented in the WPScan advisory at https://wpscan.com/vulnerability/fb68779f-40f5-4746-8b18-b0801b673edd/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-12976. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Learnpress

View all
CVE-2024-8522 CRITICAL POC
10.0 Sep 12

SQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to injec
CVE-2024-4434 CRITICAL POC
9.8 May 14

SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenti
CVE-2024-8529 CRITICAL POC
10.0 Sep 12

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter o
CVE-2021-24951 CRITICAL POC
9.8 Dec 13

The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in

CVE-2020-6010 HIGH POC
8.8 Apr 30

LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection. Rated high severity (CVS
CVE-2022-3360 HIGH POC
8.1 Oct 31

The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticat
CVE-2024-11868 MEDIUM POC
5.3 Dec 10

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio
CVE-2026-12970 HIGH POC
7.1 Jul 20

Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary

CVE-2024-4397 HIGH
8.8 May 14

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file t
CVE-2024-5483 MEDIUM POC
5.3 Jun 05

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio
CVE-2022-0271 MEDIUM POC
6.1 Apr 11

The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it bac
CVE-2024-4444 MEDIUM POC
5.3 May 14

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up t

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-12976 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy