LearnPress WordPress EUVD-2026-65272

Exploitation requires an authenticated session with the WordPress Editor role or higher (the edit_pages capability and a valid wp_rest nonce are both prerequisites). The attacker must also be able to reach the wp-admin/admin-ajax.php endpoint over the network. The vulnerability is not exploitable by Subscriber or Contributor role accounts, which do not hold edit_pages. Non-default conditions that limit exploitation include: the targeted WordPress installation must have LearnPress version 4.4.4 or earlier installed and active; at least one Editor-level (or higher, non-admin) account must exist and be compromised. The practical impact of the write is constrained to positive integers (page IDs), so options requiring string or boolean false values cannot be set to arbitrary values - but options that are truthy when non-zero (such as users_can_register) are fully controllable.

The NVD-assigned CVSS 3.1 score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) understates the realistic risk in two ways: AC:H appears to overstate complexity (the attack is a single crafted AJAX POST with no race condition or special circumstance), and A:N ignores that corrupting active_plugins can take the site fully offline. The PR:H metric is debatable - Editor is not admin-level, and some frameworks would classify it as PR:L, which would substantially raise the score. There is no EPSS data in the provided input and no CISA KEV listing, which indicates the vulnerability has not been observed in active mass exploitation. However, even a small organization managing an e-learning deployment on WordPress should treat option-write primitives seriously, because they can chain into full site takeover: enabling user registration followed by privilege escalation via a secondary flaw is a well-documented attack pattern. Wordfence is the reporting source, which adds credibility to the technical findings. The constrained impact (integer values only for the option value) limits some payloads but does not meaningfully reduce integrity risk for boolean-style options like users_can_register.

An attacker who has obtained Editor-level credentials - via credential stuffing, phishing, or a compromised contributor account - sends a crafted authenticated POST to wp-admin/admin-ajax.php with action=learnpress_create_page and field_name=users_can_register, along with a valid wp_rest nonce. The handler creates a new WordPress page (yielding a page ID of 1 or greater) and writes that truthy integer to the users_can_register option, silently opening public registration on the site. The attacker then registers a new account and, if a secondary privilege-escalation path exists, elevates to administrator. No public exploit code has been identified at time of analysis.