LearnPress CVE-2026-8383

No special conditions are required beyond the LearnPress plugin (version < 4.3.7) being installed and active on a WordPress site with its REST API reachable - the default state for WordPress. The attacker must supply a context=edit parameter in the REST request; no authentication token, session cookie, nonce, or elevated privilege is needed. Exploitation is limited in impact to user metadata disclosure (roles, capabilities, locale, registration date) - passwords, authentication tokens, and private content are not exposed by this endpoint. Sites that have disabled WordPress REST API access for unauthenticated users (a non-default hardening measure via plugin or custom filter) would not be exploitable. No specific platform, PHP version, or non-default configuration is required to be vulnerable.

The CVSS 3.1 score of 5.3 (Medium) is well-calibrated for this vulnerability: network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), no user interaction (UI:N), unscoped (S:U), with only partial confidentiality impact (C:L) and no integrity or availability impact. SSVC's 'Automatable: yes' classification confirms that exploitation can be scripted at scale across WordPress installations - a meaningful uplift over raw CVSS severity. Counterbalancing this, EPSS at 0.16% (6th percentile) is notably low given that a POC is publicly available and the attack requires no credentials or special conditions; this divergence suggests opportunistic threat actors have not yet incorporated the exploit into widespread campaigns at time of analysis. The exposed data - roles and full capabilities maps - is genuinely sensitive reconnaissance material that can pinpoint administrator accounts for credential stuffing or phishing, making the real-world risk higher than the CVSS score alone implies for sites with user enumeration exposure. No CISA KEV listing is present, so mass exploitation is not confirmed. Priority: patch promptly given automation risk and POC availability, but not a critical emergency.

An unauthenticated attacker sends a crafted HTTP GET request to the LearnPress REST API endpoint appending ?context=edit, requiring no credentials or session. The server returns a JSON payload containing each matched user's roles, full WordPress capabilities map, extra capabilities, locale, and registration date. A publicly available exploit lowers the skill barrier to near zero; the attacker parses the response to identify administrator-level accounts and uses the extracted role and capability data to prioritize targets for follow-on credential attacks or social engineering.