What’s Vulnerable › Vulnerabilities
CVE-2026-86449: LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-17
- Weakness: CWE-200
Description
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.
Affected products
- thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: from 4.2.7.1 before 4.4.7 — fixed in 4.4.7
How to fix
Upgrade to a fixed version: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses 4.4.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86449 or the next vulnerability affects your stack