EUVD-2026-66881

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78125: Exposure of Sensitive Information to an Unauthorized Actor

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

PT-2026-82427

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

WordPress LearnPress plugin < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API vulnerability

Unauthenticated Sensitive User Information Disclosure via REST API vulnerability discovered by dyingman1 in WordPress Plugin LearnPress versions 4.3.7...

CVE-2026-75982

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

CVE-2026-75982 LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

CVE-2026-75982 LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

CVE-2026-75982

The LearnPress WordPress plugin (versions up to and including 4.4.4 ) is vulnerable to unauthorized modification of arbitrary WordPress options via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce (both a...

EUVD-2026-65272

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update vulnerability

Missing Authorization to Authenticated Editor+ Limited Option Update vulnerability discovered by Wordfence PRISM in WordPress Plugin LearnPress versions = 4.4.4...

PT-2026-81163

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress create page AJAX action. The LP Admin Ajax::create page handler only checks the edit pages capability and a wp rest nonce both...

CVE-2026-75982: Missing Authorization

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

WordPress LearnPress plugin < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature vulnerability

Instructor+ Server-Side Request Forgery via openaiapplyimagefeature vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin LearnPress versions 4.4.4...

WordPress LearnPress plugin < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant vulnerability

Subscriber+ Sensitive Information Exposure via AI Assistant vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin LearnPress versions 4.4.4...

CVE-2026-12976

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

CVE-2026-12976 LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

CVE-2026-12976

The LearnPress WordPress plugin, in versions before 4.4.4 , is vulnerable to sensitive information exposure. The root cause is a failure to verify if a user is enrolled in a specific course before processing AI-assistant requests against that course's lesson content. This allows any authenticated...

EUVD-2026-57072

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

CVE-2026-12976 LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...