LearnPress CVE-2026-39717

Requires an authenticated low-privilege account on the target WordPress site running the LearnPress plugin at version 4.4.9.1 or earlier (PR:L in the CVSS vector confirms authentication is needed). Exploitation targets a specific plugin action/endpoint whose access-control check is missing or misconfigured; no user interaction is required (UI:N) and it is reachable over the network (AV:N). The principal limiting factor is the authentication requirement - anonymous/unauthenticated visitors cannot trigger it - and impact is confined to integrity (I:L) with no data disclosure or denial of service, so realistic risk is bounded to tampering within what a logged-in user can reach.

This is a genuine but comparatively low-priority vulnerability. The CVSS 3.1 base score of 4.3 (Medium) is driven by a network attack vector (AV:N) with low complexity (AC:L) but requires low-level privileges (PR:L), meaning an attacker must already hold an authenticated account (e.g., a student/subscriber) on the target WordPress site. Impact is limited to a low integrity breach (I:L) with no confidentiality (C:N) or availability (A:N) effect and no scope change (S:U), consistent with a Missing Authorization (CWE-862) / broken access control flaw where an under-privileged user can perform an action gated behind improper access controls. No EPSS score was supplied, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The only signal of real-world attention is that it was reported by Patchstack, a WordPress-focused research vendor, which indicates credible disclosure but not exploitation. Net: a real authorization-hardening issue worth patching in the normal cycle, not an emergency. Note the Tags label this 'Authentication Bypass,' which conflicts with the CWE-862/broken-access-control nature of the flaw - it is an authorization (post-login) issue, not pre-authentication bypass.

An attacker who registers or already holds a low-privilege account (such as a student) on a WordPress site running LearnPress ≤ 4.4.9.1 invokes a plugin action or endpoint that fails to properly verify the user's authorization level. They thereby modify or access data they should not control, achieving a limited integrity impact. No public exploit code is currently identified, so exploitation would require independent development.