LearnPress CVE-2026-86448

Exploitation requires that a store operator has previously generated at least one order export file within LearnPress (the feature must have been used, and an export artifact must exist on the server), and that the attacker can determine or guess that file's identifier - this determinability requirement is precisely what AC:H captures. No authentication, capability, nonce, or user interaction is needed (PR:N/UI:N) once a valid identifier is known. Limiting factors: sites that never generated order exports have nothing to leak; the identifier must be discovered/enumerated, which may not be trivial; impact is confidentiality-only (no integrity or availability effect). Affects LearnPress versions 4.3.2.8 through before 4.4.7; upgrading to 4.4.7 remediates.

This is a genuine but modest-severity data-exposure issue, not a critical priority. The CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) correctly reflects an unauthenticated, network-reachable confidentiality-only flaw whose severity is held down by AC:H - the attacker must first determine the identifier of a previously generated order export file, which is a non-trivial prerequisite rather than a guaranteed, direct fetch. EPSS reinforces low mass-exploitation likelihood: 0.22% probability at the 13th percentile, indicating attackers are not broadly automating this. There is NO CISA KEV listing, so there is no confirmed active exploitation. However, a public exploit does exist (WPScan advisory 7b085c19), which raises the practical floor for opportunistic abuse - POC availability and active exploitation are distinct signals and only the former applies here. Net: patch as routine hygiene (real PII leakage: customer names, purchases, amounts, guest emails) but this is not an emergency. No signals are strongly conflicting; the main uncertainty is how predictable the export-file identifier is, which directly governs the real-world value of AC:H.

An unauthenticated attacker identifies a WordPress site running LearnPress and determines the identifier of an order export file that a store operator previously generated, then requests that file directly over HTTP without any login, nonce, or capability. Because no access control is enforced on the download endpoint, the server returns the export containing customer names, purchases, amounts, and guest email addresses. A public exploit is available via WPScan, lowering the effort required to weaponize this.