6 matches found
CVE-2023-6634
Эксплойт-скрипт для CVE-2023-6634 Описание Этот репозиторий содержит скрипт на Python, предназначенный для эксплуатации уязвимости CVE-2023-6634, обнаруженной в плагине LearnPress для WordPress версий до 4.2.5.7 включительно. Уязвимость позволяет удаленно выполнять код RCE из-за некорректной...
CVE-2026-86447 LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...
CVE-2026-86445
The LearnPress WordPress plugin (versions 4.2.9-4.4.6 ) is vulnerable to an unauthenticated question bank disclosure due to a failure to check user capabilities in one of its administrative template handlers. Specifically, the load_content_via_ajax handler allows attackers to retrieve the text, i...
CVE-2026-86447 LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...
CVE-2026-86445 LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, whi...
CVE-2025-11368: Exposure of Sensitive Information to an Unauthorized Actor
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/loadcontentviaajax which allows arbitrary callback execution of...