LearnPress EUVD-2026-109994

Exploitation requires only network reachability to a site running LearnPress version 4.4.11 or earlier; per CVSS PR:N/UI:N it needs no authentication and no user interaction, so default installations within the affected range are exposed. The limiting factors are impact scope and data value, not access difficulty: the flaw yields only a LOW confidentiality impact (C:L, I:N, A:N), meaning it exposes restricted information rather than enabling account takeover, content modification, or site disruption. The specific feature, endpoint, or configuration that is improperly access-controlled is not described in the available sources, so defenders should consult the Patchstack advisory to determine exactly what data is exposed in their deployment.

This is a moderate-severity, low-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes a remotely reachable, low-complexity, unauthenticated flaw whose only impact is a LOW loss of confidentiality - no integrity or availability impact and no scope change. The CWE-862 (Missing Authorization) classification and the Patchstack advisory title ('broken access control') indicate an unauthorized actor can reach data or an endpoint that should be access-controlled, consistent with the confidentiality-only impact. Several key exploitation signals are MISSING from the input: there is no EPSS probability provided, no CISA KEV listing, and no verified exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with a disclosure-driven, not exploitation-driven, prioritization. The sole reference is the Patchstack/ENISA EUVD advisory itself, reported by Patchstack. Net: a genuine but limited information-exposure bug in a popular plugin - worth patching on a routine monthly cycle, not a drop-everything event, unless the exposed data proves sensitive in your deployment (verify what the endpoint discloses against the vendor advisory).

A remote, unauthenticated attacker sends a direct request to a LearnPress endpoint (e.g. an AJAX/REST action) that fails to enforce an authorization check, retrieving information that should be restricted to privileged users. No user interaction or credentials are required, but impact is limited to confidentiality (CVSS C:L) with no data modification. No public exploit identified at time of analysis; the specific vulnerable endpoint and exact trigger are not described in the available sources.