LearnPress EUVD-2026-109991

Requires an authenticated account with at least low privileges (PR:L) on a WordPress site running LearnPress version ≤4.4.11; the specific vulnerable feature or endpoint is not described in the available sources, which characterize it only as incorrectly configured access control (missing authorization, CWE-862). Limiting factors that reduce real-world risk: the attacker must possess a valid low-privilege account (though LMS sites offering courses frequently permit open self-registration, easing this), impact is limited to partial confidentiality and integrity (C:L/I:L) with no availability impact, and scope is unchanged. No user interaction is required once authenticated.

This is a medium-severity (CVSS 5.4) missing-authorization flaw (CWE-862) whose signals point to a moderate, not urgent, priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N indicates a network-reachable, low-complexity issue that nonetheless requires some authenticated privilege (PR:L) and yields only limited confidentiality and integrity impact with no availability effect. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with the moderate CVSS. No EPSS score, no CISA KEV listing, and no verified public exploit are present in the supplied data, so there is no evidence of active exploitation or a published weaponized PoC. The one reference is a Patchstack advisory (the reporter), which confirms the finding but is not exploit code. Net: a genuine but modest fix-this-cycle issue, not a high-CVSS-but-hollow finding nor a drop-everything emergency. Key missing signals to note explicitly: EPSS and KEV data are absent from the input (absence is not evidence either way), and the fixed version is not stated in the available sources - verify remediation with ThimPress/Patchstack.

On a WordPress site running LearnPress ≤4.4.11, an attacker who holds a low-privilege account (such as a student/subscriber, which LMS sites commonly allow self-registration for) sends a request to a LearnPress function whose access-control check is missing or misconfigured, letting them read or alter data beyond their authorization. The exact vulnerable endpoint and trigger are not described in the available sources, and no verified public exploit code was identified.