CVE-2026-86449

UNKNOWN 0.0

LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.

Vendor	unknown
Product	learnpress
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for unknown learnpress

Be the first to know when new unknown vulnerabilities affecting unknown learnpress are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / LearnPress

4.2.7.1 < 4.4.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/1c085889-fa9d-4827-8ff3-3b1d48fb2681/

Credits

Sai Praneeth Koti WPScan