CVE-2026-86446 LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken...

CVE-2026-86446

The LearnPress WordPress plugin (versions 4.4.3-4.4.6 ) is vulnerable to an unauthenticated quiz answer disclosure via the check-answer REST endpoint . The software fails to restrict the correctness flags returned when a quiz answer is checked. This allows unauthenticated attackers to obtain the ...

WordPress LearnPress plugin 4.4.3-4.4.6 - Unauthenticated Quiz Answer Disclosure vulnerability

Unauthenticated Quiz Answer Disclosure vulnerability discovered by Nicat Sultanov in WordPress Plugin LearnPress versions 4.4.3-4.4.6...

CVE-2026-86446 LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken...

PT-2026-94162

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.7 Description The plugin fails to restrict the correctness flags returned during the quiz answer verification process. This allows unauthenticated attackers to retrieve the correct answers for all options of a...

CVE-2026-86446: Exposure of Sensitive Information to an Unauthorized Actor

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken...

CVE-2026-86444

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

CVE-2026-86448

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...

CVE-2026-86449

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

CVE-2026-86445

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, whi...

CVE-2026-86447

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...

CVE-2026-86448 LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...

CVE-2026-86449 LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

WordPress LearnPress plugin 4.3.2.8-4.4.6 - Unauthenticated Order Data Disclosure vulnerability

Unauthenticated Order Data Disclosure vulnerability discovered by Artus KG in WordPress Plugin LearnPress versions 4.3.2.8-4.4.6...

EUVD-2026-80203

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...

CVE-2026-86447 LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...

EUVD-2026-80204

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

WordPress LearnPress plugin 4.2.7.1-4.4.6 - Unauthenticated Unpublished Course Disclosure vulnerability

Unauthenticated Unpublished Course Disclosure vulnerability discovered by Sai Praneeth Koti in WordPress Plugin LearnPress versions 4.2.7.1-4.4.6...

EUVD-2026-80202

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...

CVE-2026-86448

The LearnPress WordPress plugin (versions 4.3.2.8 through 4.4.6 ) is vulnerable to an unauthenticated order data disclosure. The root cause is a lack of authentication, capability, or nonce checks before serving previously generated order export files via the lp_download_order function. An unauth...