LearnPress CVE-2026-8502

Exploitation requires the LearnPress plugin to be active on a WordPress installation (versions up to and including 4.3.6) and the WordPress REST API to be publicly accessible (default configuration). The attacker must supply exactly two query parameters in a single request: c_status=all (bypasses the post_status='publish' WHERE clause) AND return_type=json (suppresses the DISTINCT(ID) AS ID field override). Both parameters must be present simultaneously - either alone is insufficient to trigger the full unrestricted SELECT *. No authentication is required (PR:N confirmed by CVSS vector). No special WordPress roles, plugin settings, or non-default configurations are needed beyond the plugin being installed and active. Exploitation is limited to reading data from the WordPress posts table for LearnPress course post types; it does not provide write access, code execution, or access to non-course post types. Sites that have removed or restricted the WordPress REST API via firewall, .htaccess, or plugin (e.g., Disable REST API) are not exploitable via this vector.

The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N understates operational risk in specific deployment contexts. While the confidentiality impact is scored Low (C:L) - reflecting partial rather than full system disclosure - the actual data exposed is high-value: plaintext course passwords and the full body of unreleased course content represent material business and security risk for e-learning operators. The attack complexity is genuinely Low: no authentication, no interaction, no race condition - a single HTTP GET with two known parameters suffices. EPSS data was not provided; however, given the unauthenticated, network-accessible nature and clear exploitation instructions in the CVE description, opportunistic scanning is a realistic threat vector. No CISA KEV listing and no confirmed public exploit code temper urgency, but the trivially scriptable nature means proof-of-concept development requires minimal skill. The vulnerability is not a false high-CVSS issue - the CVSS score arguably underrepresents real-world impact for sites with confidential unpublished content or password-gated courses. There is no conflicting signal between CVSS vector and the description; both consistently indicate unauthenticated network exploitation.

An unauthenticated attacker sends a single HTTP GET request to https://target-site.com/wp-json/lp/v1/courses/archive-course?c_status=all&return_type=json with no credentials. The plugin's REST controller passes both parameters to the database query builder, where c_status=all suppresses the publish-only WHERE clause and return_type=json suppresses the safe DISTINCT(ID) field projection, causing a SELECT * query to return all course rows regardless of visibility status. The attacker receives a JSON response containing the plaintext post_password for every password-protected course and the full post_content, post_author, and post_name of every draft, private, and pending course - allowing them to access gated content, enumerate unpublished material, or target course authors. No public exploit code has been identified at time of analysis, but the exploitation path is fully described in the CVE and requires no specialized tooling.