What’s Vulnerable › Vulnerabilities
CVE-2026-86448: LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order
- Severity: low (CVSS 3.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-17
- Weakness: CWE-200
Description
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email addresses.
Affected products
- thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: from 4.3.2.8 before 4.4.7 — fixed in 4.4.7
How to fix
Upgrade to a fixed version: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses 4.4.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86448 or the next vulnerability affects your stack