LearnPress CVE-2026-42690

Exploitation requires an authenticated subscriber-level WordPress account on a site running LearnPress ≤ 4.4.10 (CVSS PR:L), and no user interaction (UI:N). The limiting factor is this authentication requirement - an anonymous, unauthenticated attacker cannot exploit it directly; however, the barrier is low on any LearnPress deployment that permits open student/subscriber self-registration, which is common for course platforms. The specific vulnerable feature, endpoint, or configuration is not described in the available sources, so the precise action gated by the missing authorization check cannot be named from this input.

This is a moderate-severity, authorization-level issue (CWE-862, Missing Authorization) rated CVSS 5.4 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The vector indicates network-reachable, low-complexity exploitation requiring low privileges (PR:L) - consistent with the title 'Subscriber Broken Access Control', meaning an authenticated subscriber-level account is the prerequisite, not an anonymous remote attacker. Impact is partial confidentiality and integrity (C:L/I:L) with no availability impact and no scope change (S:U), so this is an access-control boundary violation allowing a low-privileged user to reach data or actions beyond their role, rather than full compromise. On decision signals: the vuln.today priority is 'this_month' (not act_now/emergency), there is NO CISA KEV listing and no EPSS score in the provided data, and no verified working exploit code - so the signals are internally consistent in pointing to a non-emergency, patch-in-normal-cycle item. EPSS is absent, so probability of exploitation cannot be quantified from this input; its absence is not evidence of low risk. The realistic threat is bounded by the authentication requirement: any site allowing open subscriber/student registration (common for a LearnPress-based course site) effectively lowers the barrier, since anyone can self-register to obtain the needed PR:L foothold. No conflict exists between the CVSS vector and the description - both agree on authenticated (subscriber) network access.

An attacker registers or already holds a subscriber/student account on a WordPress site running LearnPress 4.4.10 or earlier, then issues a crafted request to a plugin endpoint that fails to enforce authorization, reading or modifying data belonging to other users or beyond the subscriber role. Because self-registration is typical on course-selling LearnPress sites, obtaining the required low-privilege account is often trivial. No verified public exploit code is identified in the provided data, and the specific vulnerable endpoint and action are not described in the available sources.