CVE-2026-78125
LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.
| Vendor | unknown |
| Product | learnpress |
| Published | Aug 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown learnpress
Be the first to know when new unknown vulnerabilities affecting unknown learnpress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / LearnPress
0 < 4.0.3
References
Credits
Shikhali Jamalzade WPScan