Is there a public PoC exploit available for EUVD-2026-80201?

Yes, a public proof-of-concept exploit is available for EUVD-2026-80201. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for EUVD-2026-80201?

Yes, a patch is available for EUVD-2026-80201. Update the affected software to the latest version immediately.

Learnpress EUVD-2026-80201

| CVE-2026-86445

2026-09-16 WPScan

GHSA-239j-g7xf-h6v8

WordPress Information Disclosure Learnpress

Lifecycle Timeline

Patch available

Sep 16, 2026 - 07:01 EUVD

CVE Published

Sep 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.

Analysis

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Learnpress

View all

CVE-2024-8522 CRITICAL Act Now POC

10.0 Sep 12

SQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to injec

CVE-2023-6634 HIGH Act Now POC

8.1 Jan 11

The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via

CVE-2023-6567 CRITICAL Emergency POC

9.8 Jan 11

The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versio

CVE-2024-4434 CRITICAL Emergency POC

9.8 May 14

SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenti

CVE-2024-8529 CRITICAL Act Now POC

10.0 Sep 12

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter o

CVE-2021-24951 CRITICAL Act Now POC

9.8 Dec 13

The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in

CVE-2026-12976 MEDIUM This Month POC

6.5 Aug 12

Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authent

CVE-2020-6010 HIGH This Week POC

8.8 Apr 30

LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection. Rated high severity (CVS

CVE-2022-3360 HIGH This Week POC

8.1 Oct 31

The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticat

CVE-2024-11868 MEDIUM This Month POC

5.3 Dec 10

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio

CVE-2026-12970 HIGH This Week POC

7.1 Jul 20

Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary

CVE-2024-4397 HIGH This Week

8.8 May 14

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file t

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

EUVD-2026-80201 vulnerability details – vuln.today

Back