EUVD-2026-80204
GHSA-gwwh-q58c-5868
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running LearnPress <4.4.7
-
DeliverySend unauthenticated REST request with post_status filter
-
ExploitBypass missing capability check
-
ExecutionReceive draft/pending/private/scheduled/trashed course listings
-
ImpactHarvest unpublished course data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of any site running LearnPress before 4.4.7 (versions 4.2.7.1 up to but not including 4.4.7). The vulnerable REST route is reachable without authentication or user interaction; the only prerequisite is that the plugin is installed and active. The limiting factor is impact scope, not access: exploitation only discloses non-published course listings (draft, pending, private, scheduled, trashed) and does not grant write access, code execution, or exposure of unrelated sensitive data. |
| Impact | This is a genuine but modest-severity information-disclosure flaw (CWE-200), best treated as low-to-moderate priority. The CVSS 3.1 base of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is well-calibrated: the vector is network, complexity is low, and no privileges or user interaction are needed, but impact is confidentiality-only and limited (C:L) - an attacker learns the existence and metadata of non-published courses via an unprotected REST route, not full site compromise. Exploitation signals are mixed but consistent: a public exploit exists (WPScan), yet EPSS is only 0.19% (9th percentile) and there is no CISA KEV listing, indicating publicly available exploit code exists but no confirmed active exploitation - the low EPSS reflects the limited, low-value payoff rather than difficulty. There is no SSVC data in the input; while the flaw is technically automatable (a single unauthenticated request), the technical impact is partial/information-only, so mass exploitation is unlikely to be attractive. Net: prioritize patching as routine hygiene on affected sites, but this is not an emergency compared to the RCE/privesc-class bugs. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the vulnerable LearnPress REST route, supplying a post-status filter value such as 'draft', 'pending', 'private', 'future', or 'trash'. Because the route never checks the caller's capabilities before applying the filter, the API returns courses in those non-public states, disclosing unpublished course titles, IDs, and metadata to anyone. A public exploit is available via WPScan, making this trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Unauthenticated information disclosure in the LearnPress WordPress plugin affects all sites running versions from 4.2.7.1 up to but not including 4.4.7, where a REST route applies a user-supplied post status filter without checking the caller's capabilities. Any remote attacker, with no authentication or user interaction and no special configuration, can enumerate non-public course entries - drafts, pending, private, scheduled and trashed items - exposing content the site owner intended to keep hidden. Publicly available exploit code exists and the vendor has released a fix in 4.4.7, but EPSS is only 0.19% (9th percentile) and there is no confirmed active exploitation (no CISA KEV listing), making this a genuine but modest-severity exposure best treated as low-to-moderate priority; the impact is limited to disclosure of course listing metadata and does not include write access, code execution, or exposure of unrelated sensitive data.
RemediationAI
Upgrade the LearnPress plugin to 4.4.7 or later as soon as practical - this is the vendor-released patch that adds the missing capability check to the affected REST route, and sites on the EUVD-confirmed range 4.2.7.1 through 4.4.7-exclusive should prioritize it. Advisory details are at https://wpscan.com/vulnerability/1c085889-fa9d-4827-8ff3-3b1d48fb2681/ and https://nvd.nist.gov/vuln/detail/CVE-2026-86449. Because EPSS is low (0.19%) and there is no confirmed active exploitation, emergency out-of-band change control is not required, but scheduling the update within a normal patch window is appropriate. If an immediate upgrade is not possible, the most direct compensating control is to block unauthenticated access to the affected LearnPress REST namespace at the web server, reverse proxy or WAF layer (for example, deny external requests to the plugin's /wp-json/learnpress/ routes for anonymous callers while allowing authenticated sessions); the trade-off is that any legitimately public, unauthenticated front-end course browsing or AJAX features served through those same routes will break for logged-out visitors, so the rule must be scoped and tested. A broader alternative is to disable the WordPress REST API for unauthenticated users entirely, but this commonly disrupts other plugins, blocks and headless consumers. Deactivating LearnPress removes the exposure completely but takes course functionality offline. Note that tightening REST permissions does not retroactively protect already-leaked draft, private or trashed course data, so operators should also review non-public content for sensitive information that may have been indexed or cached during the exposure window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) caused by a missing authorization check in a WordPress REST API endpoint. WordPress REST routes conventionally gate sensitive queries behind capability checks such as current_user_can('edit_others_posts') or current_user_can('read_private_posts'); in the affected LearnPress builds, one route accepts an attacker-controlled post status parameter and passes it into the underlying query (WP_Query-style post_status filtering) without verifying that the caller is allowed to see non-published content. Because the route is registered with public, unauthenticated access (matching the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector), anyone who can reach the site's REST interface can request the hidden statuses. The CPE data (cpe:2.3:a:unknown:learnpress:*:*:*:*:*:*:*:*) confirms the affected component is the LearnPress plugin itself rather than a WordPress core or theme package, and EUVD records the vulnerable range as 4.2.7.1 through versions before 4.4.7. The vulnerability is confined to read/listing behavior - there is no injection, deserialization, or file-write primitive, which is why the assessed confidentiality impact is Low and integrity/availability impacts are None.
Know when Learnpress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network REST request with no user interaction (AV:N/AC:L/PR:N/UI:N); confidentiality-only, limited disclosure of unpublished course metadata (C:L, I:N/A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Learnpress
View allSQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to injec
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versio
SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenti
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter o
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in
Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authent
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection. Rated high severity (CVS
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticat
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio
Reflected cross-site scripting in the LearnPress WordPress plugin before 4.4.7 allows unauthenticated attackers to injec
Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary
Exploit-DB