LearnPress EUVD-2026-91380

Exploitation targets LearnPress versions from n/a through 4.4.9 running on WordPress; per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required against a default installation. The attacker needs only to reach an exposed LearnPress request handler that accepts a user-controlled key/identifier and manipulate that identifier to reference another user's object. The primary limiting factor is the confidentiality-only impact (C:L, I:N, A:N): the flaw permits unauthorized read access to specific LearnPress data objects but does not allow modification, deletion, or full account takeover. Risk is concentrated on sites exposing sensitive learner, order, or course data; sites not yet upgraded past 4.4.9 are affected.

This is a medium-severity (CVSS 5.3) IDOR/authorization bypass in the LearnPress WordPress plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-based, low-complexity, unauthenticated exploitation with no user interaction, which normally elevates priority - however, the impact is deliberately narrow: confidentiality-only (C:L) with no integrity or availability impact and no scope change (S:U), meaning an attacker can read data they shouldn't but cannot modify or destroy it. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code identified at time of analysis, so there is no public exploit identified at time of analysis. On balance this is a genuine but modest-risk issue: the unauthenticated network vector makes it opportunistically scannable across exposed WordPress sites, but the limited confidentiality-only impact keeps it well below critical-priority. Treat as a routine-but-prompt patch rather than an emergency, prioritizing sites that handle sensitive learner data.

An unauthenticated attacker enumerates or manipulates a user-controlled object identifier (e.g., an ID parameter in a LearnPress request) to access course, order, or user records belonging to other users without authorization. Because the flaw requires no authentication, user interaction, or special complexity, it can be probed remotely at scale; no public proof-of-concept was identified in the provided data.