What is the CVSS score of CVE-2026-8383?

CVE-2026-8383 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-8383?

Yes, a public proof-of-concept exploit is available for CVE-2026-8383. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-8383?

Yes, a patch is available for CVE-2026-8383. Update the affected software to the latest version immediately.

LearnPress CVE-2026-8383

EUVD-2026-37558 MEDIUM

Missing Authorization (CWE-862)

2026-06-17 WPScan

WordPress Authentication Bypass Learnpress

5.3

CVSS 3.1 · CISA-ADP

Severity by source

CISA-ADP PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network REST endpoint, no complexity or interaction; only partial confidentiality impact with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from CISA-ADP.

CVSS VectorCISA-ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:21 vuln.today

Patch available

Jun 17, 2026 - 09:01 EUVD

CVE Published

Jun 17, 2026 - 06:00 cve.org

MEDIUM 5.3

CVE Published

Jun 17, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The LearnPress WordPress plugin before 4.3.7 does not gate the edit context on one of its REST endpoint behind the edit_users capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request

AnalysisAI

LearnPress WordPress plugin versions prior to 4.3.7 expose sensitive user account metadata to unauthenticated visitors through a REST API endpoint that fails to enforce the required edit_users capability gate on its edit context. Any unauthenticated caller can issue a crafted REST request and receive each user's roles, full capabilities map, extra capabilities, locale, and registration date - data that enables targeted follow-on attacks against privileged accounts. A publicly available exploit exists per WPScan disclosure, and SSVC classifies exploitation as automatable; however, no public exploit identified at time of analysis has reached CISA KEV status, and EPSS remains at 0.16% (6th percentile), suggesting limited observed mass exploitation despite low attack complexity.

Technical ContextAI

LearnPress is a WordPress Learning Management System plugin. WordPress REST API endpoints support a context parameter - view, embed, or edit - that controls how much detail is returned per object. The edit context is designed to expose additional privileged fields (roles, capabilities, locale) and is supposed to require the edit_users capability, typically held only by administrators. The vulnerability (CWE-862: Missing Authorization) occurs because LearnPress does not enforce this capability check before returning the edit context response, allowing unauthenticated HTTP clients to receive the enriched user payload. The affected scope is confirmed by CPE cpe:2.3:a:unknown:learnpress:*:*:*:*:*:*:*:*, covering all versions through 4.3.6 as reported by WPScan and corroborated by EUVD entry EUVD-2026-37558.

RemediationAI

The primary fix is to update LearnPress to version 4.3.7 or later, which introduces proper edit_users capability enforcement on the affected REST endpoint. Updates can be applied through the WordPress admin dashboard under Plugins > Installed Plugins, or via WP-CLI using wp plugin update learnpress. Vendor advisory: https://wpscan.com/vulnerability/b7cbf68b-62c5-4787-b84b-69df9e0122b2/. If an immediate upgrade is not feasible, a targeted compensating control is to block unauthenticated access to the WordPress REST API entirely using a security plugin (e.g., Disable REST API) or a WAF rule filtering requests to the affected endpoint that include the context=edit query parameter - note that blanket REST API blocking may break other plugins or themes that depend on public REST access, so test in staging first. A narrower WAF rule targeting context=edit on LearnPress-specific routes carries lower collateral risk.