EUVD-2026-80201
GHSA-239j-g7xf-h6v8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
DeliverySend request to unprotected admin template handler
-
ExploitMissing capability check bypassed
-
ExecutionEnumerate/keyword-search all published quiz questions
-
ImpactExfiltrate question text, IDs, and types
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the LearnPress WordPress plugin in versions 4.2.9 through before 4.4.7. The only prerequisite is that the site publishes quiz questions (i.e., LearnPress is actively used for courses/quizzes), since the flaw exposes published quiz-question content. No authentication, user interaction, or non-default settings are required; the sole limiting factor is that the affected administrative template handler must be reachable, which it is by default on a running LearnPress installation. |
| Impact | This is a genuine but low-severity information disclosure issue, not a high-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) reflects trivially reachable, unauthenticated, network-based access with only limited confidentiality impact and no integrity or availability effect - consistent with CWE-200. Signals align rather than conflict: EPSS is low at 0.19% (9th percentile), the CVE is NOT in CISA KEV, and while a public exploit exists via WPScan, that indicates ease of reproduction, not active mass exploitation. The disclosed data (quiz question text, identifiers, and type, plus keyword search) is low value - academic integrity / content-leakage impact rather than credentials or PII - which supports the C:L rating. Net assessment: real and easy to trigger (patch it), but the practical harm is modest and there is no evidence of widespread or automated exploitation. No key data is missing or contradictory here; the CVSS vector, description, and CWE are mutually consistent. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to LearnPress's administrative template handler, which fails to verify the caller's capabilities, and receives back the text, ID, and type of every published quiz question on the site, optionally filtered by keyword search. A public proof-of-concept is available (WPScan), so exploitation requires no custom tooling. This lets a student or competitor harvest an entire course's quiz question bank that the plugin is supposed to keep non-public. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Unauthenticated information disclosure in the LearnPress WordPress plugin (versions 4.2.9 through before 4.4.7) lets any remote attacker query an administrative template handler that performs no capability check, returning the text, identifier, and type of every published quiz question on the site plus keyword search over that content - material the plugin otherwise keeps non-public. All default installations that actively publish LearnPress courses or quizzes are affected; no authentication, user interaction, or non-default configuration is required, as confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N vector. Publicly available exploit code exists and WPScan has published the vulnerability, though EPSS is only 0.19% (9th percentile), and the independent assessment rates this a genuine but low-severity information disclosure issue rather than a high-priority emergency; a vendor patch is available in 4.4.7.
RemediationAI
Vendor-released patch: upgrade LearnPress to 4.4.7 or later, which is the exact fixed version and the primary and recommended remediation - verify the installed plugin version under WordPress Plugins, apply the update, and confirm the deployment since many sites leave plugin auto-updates disabled. There is no documented secondary patch or hotfix version, so if an immediate upgrade is not possible, deploy compensating controls targeted at the specific weakness: add a WAF or reverse-proxy rule that rejects unauthenticated requests to the affected LearnPress administrative template handler (and to plugin-specific admin-ajax.php actions), accepting that this requires identifying the handler in traffic and may break legitimate front-end or admin-adjacent AJAX behavior; alternatively, temporarily unpublish quiz content or restrict the quiz feature set so no non-public question text is stored on a publicly reachable site, with the clear trade-off of degrading the course/quiz functionality the plugin was installed for. Because exploitation is unauthenticated and only exposes published quiz-question content, an attack does not leave privileged footprints, so if a vulnerable version was exposed, review access logs for enumeration or keyword-search patterns against the handler before assuming the site was untouched. Full details and the vendor-referenced advisory are at https://wpscan.com/vulnerability/df2d1ebb-ac1d-430d-8e99-7d88df47cf5b/ and https://nvd.nist.gov/vuln/detail/CVE-2026-86445.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LearnPress is a WordPress learning-management plugin that stores courses, lessons, and quizzes as custom post types and exposes administrative template handlers within the WordPress architecture (typically reachable via admin-side template routing such as admin-ajax.php/admin-post.php or plugin template includes that are loaded before WordPress's normal capability enforcement on the admin_init/admin_menu hooks). The flaw is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): one such administrative handler omits the current_user_can() capability check (and likely the associated nonce/authorization guard) that the rest of the plugin's administrative surface applies, so the request is processed regardless of the caller's role or login state. Because the handler is reachable unauthenticated (PR:N), an attacker can enumerate quiz-question metadata and full question text, and additionally run keyword searches against that corpus, effectively gaining a read-only view of content the plugin treats as non-public. The CPE entry cpe:2.3:a:unknown:learnpress:*:*:*:*:*:*:*:* reflects an unresolved vendor field in the NVD feed rather than any ambiguity about the affected component; EUVD records the affected range as LearnPress 4.2.9 through versions before 4.4.7. Confidentiality impact is limited (C:L) and there is no integrity or availability impact, which is consistent with a pure disclosure bug in an administrative template handler.
Know when Learnpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network request to an unprotected handler (AV:N/AC:L/PR:N/UI:N); only limited, low-value quiz content is disclosed (C:L) with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Learnpress
View allSQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to injec
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versio
SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenti
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter o
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in
Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authent
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection. Rated high severity (CVS
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticat
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio
Reflected cross-site scripting in the LearnPress WordPress plugin before 4.4.7 allows unauthenticated attackers to injec
Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary
Exploit-DB