What’s Vulnerable › Vulnerabilities
CVE-2026-86445: LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-17
- Weakness: CWE-200
Description
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
Affected products
- thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: from 4.2.9 before 4.4.7 — fixed in 4.4.7
How to fix
Upgrade to a fixed version: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses 4.4.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86445 or the next vulnerability affects your stack