LearnPress EUVD-2026-80202

No special conditions - remote unauthenticated exploitation against default configurations of the LearnPress WordPress plugin (before 4.4.7), because an administrative course tool omits its capability check. The only practical prerequisites are that the site runs a vulnerable LearnPress version and that a course has enrolled students whose data can be returned; email recovery specifically requires using the handler's search filter. Limiting factors are minimal: no authentication, no user interaction, and low attack complexity, so the primary real-world constraint is simply that the impact is confined to disclosure of enrolled-student PII (names, user IDs, emails) rather than any system compromise.

This is a genuine but low-severity information-disclosure issue, and the multiple signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) matches the description precisely: a missing capability check in an administrative course tool exposes data over the network to unauthenticated attackers with no user interaction, and impact is confined to confidentiality (C:L) with no integrity or availability effect. EPSS is low at 0.19% (9th percentile) and there is no CISA KEV listing, so despite a publicly available WPScan proof-of-concept this is not evidence of active exploitation - POC availability and active exploitation are distinct signals. The realistic risk is a targeted privacy/PII leak (enrolled students' display names, user IDs, and, via the search filter, email addresses) rather than a server-compromise vector; there is no path to code execution or privilege escalation from this flaw alone. Priority should be moderate: patch in normal cycles, prioritizing sites with large enrolled userbases or GDPR/PII exposure concerns. Note the CPE lists vendor as 'unknown:learnpress' - the real vendor is ThimPress; this is metadata junk, not a substantive conflict.

An unauthenticated attacker sends a crafted request directly to LearnPress's administrative course-tool handler, which fails to verify the caller's capabilities, and receives back the display names and user IDs of every student enrolled in a target course. The attacker then abuses the same handler's search filter to recover enrolled students' email addresses, harvesting a PII list suitable for phishing or spam. A public WPScan proof-of-concept exists, and the low attack complexity (AC:L, no auth, no user interaction) makes reproduction straightforward.