CVE-2026-86448
LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order
CVSS Score
3.7
EPSS Score
0.2%
EPSS Percentile
13th
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email addresses.
| Vendor | unknown |
| Product | learnpress |
| Published | Sep 16, 2026 |
| Last Updated | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown learnpress
Be the first to know when new low vulnerabilities affecting unknown learnpress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / LearnPress
4.3.2.8 < 4.4.7
References
Credits
Artus KG WPScan