What is the CVSS score of EUVD-2026-57072?

EUVD-2026-57072 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 15.0%.

Is there a public PoC exploit available for EUVD-2026-57072?

Yes, a public proof-of-concept exploit is available for EUVD-2026-57072. Prioritise patching immediately. EPSS: 15.0%.

Is there a patch available for EUVD-2026-57072?

Yes, a patch is available for EUVD-2026-57072. Update the affected software to the latest version immediately.

LearnPress EUVD-2026-57072

| CVE-2026-12976 MEDIUM

Information Exposure (CWE-200)

2026-08-12 WPScan

GHSA-3cx5-39h2-fchh

WordPress Information Disclosure Learnpress Unknown

6.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-exploitable with only a subscriber-level authenticated account (PR:L); no complexity barriers; impact is confidentiality-only as lesson content is read but cannot be altered.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:56 vuln.today

CVSS changed

Aug 12, 2026 - 20:22 NVD

6.5 (MEDIUM)

Patch available

Aug 12, 2026 - 07:16 EUVD

CVE Published

Aug 12, 2026 - 06:00 cve.org

MEDIUM 6.5

CVE Published

Aug 12, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.

AnalysisAI

Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authenticated user - including low-privilege subscribers - to retrieve lesson material from courses they have not purchased or enrolled in. The flaw resides in the plugin's AI-assistant feature, which processes lesson content requests without first verifying the requesting user's enrollment status, exposing an authorization bypass at the content-serving layer. With a publicly available proof-of-concept from WPScan and a 15% EPSS score, this is a realistic and low-barrier threat to any WordPress e-learning deployment running an affected version.

Technical ContextAI

LearnPress is a WordPress learning management system plugin, and the vulnerable component is its AI-assistant integration, which retrieves and serves lesson content to users for AI-driven interactions. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the AI-assistant request handler processes course and lesson data without performing an authorization or enrollment check, a broken object-level authorization (BOLA/IDOR) pattern applied to a content-serving endpoint. The affected CPE is cpe:2.3:a:unknown:learnpress:*:*:*:*:*:*:*:*, covering all releases prior to 4.4.4. The vulnerability is architectural - the feature was added without integrating the existing enrollment-verification logic that governs other content access paths in the plugin.

RemediationAI

The primary remediation is to upgrade LearnPress to version 4.4.4 or later, which introduces proper enrollment verification prior to processing AI-assistant content requests; the vendor-released patch is confirmed available and documented in the WPScan advisory at https://wpscan.com/vulnerability/fb68779f-40f5-4746-8b18-b0801b673edd/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-12976. If an immediate upgrade is not operationally feasible, administrators should disable the AI-assistant feature within the LearnPress plugin settings as a compensating control - this eliminates the vulnerable endpoint entirely but removes AI-assistant functionality for all users, including legitimate paying students. As a secondary measure, restricting site registration to prevent anonymous subscriber account creation reduces the pool of potential attackers to already-trusted users, but does not eliminate risk from malicious insiders or compromised accounts and should not be treated as a sufficient standalone mitigation.