CVE-2026-8502
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The LearnPress plugin for WordPress up to version 4.3.6 exposes sensitive data via the 'return_type' parameter. An unauthenticated attacker can extract passwords for protected courses and content, author, and name of unpublished posts.
Risk Assessment
Risk of leaking sensitive course data and unpublished content, potentially compromising user privacy and platform integrity.
Recommendation
Update the LearnPress plugin to the latest version. If no update is available, temporarily restrict access to the /wp-json/lp/v1/courses/archive-course endpoint.
Other vulnerabilities in LearnPress
See all- CVE-2026-75982Medium
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to and including 4.4.4 via the learnpress_create_page AJAX action. Attackers with Editor-level access can update arbitrary options, such as users_can_register or active_plugins, potentially enabling public registration or breaking the site.
- CVE-2026-12976Medium
The LearnPress WordPress plugin before version 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.
- CVE-2026-12970High
The LearnPress WordPress plugin before version 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting (XSS). An attacker can exploit this vulnerability to execute a malicious script in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.
- CVE-2026-13765High
The LearnPress WordPress LMS plugin up to version 4.4.1 is vulnerable to sensitive information exposure via the check_answer function. Unauthenticated attackers can extract correct answer markers, full option lists, explanations, and question content for any quiz question, including those from paid courses the attacker is not enrolled in.
- CVE-2026-12732Medium
The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to and including 4.4.0. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts that execute when users visit the affected page.
- CVE-2026-11988Medium
The LearnPress WordPress LMS plugin up to version 4.3.9.1 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'userId' parameter. An authenticated attacker with subscriber-level access or higher can view course enrollment progress and completion data belonging to instructors and administrators.
- CVE-2026-48865High
LearnPress WordPress plugin is vulnerable to Reflected XSS due to improper input neutralization during page generation. Affects versions up to 4.3.6.
- CVE-2026-4333Medium
The LearnPress – WordPress LMS Plugin is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. Insufficient input sanitization and output escaping on the 'skin' attribute allows authenticated attackers (Contributor-level and above) to inject arbitrary web scripts.
Original NVD description (English source)
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the 'return_type' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the plaintext post_password of password-protected courses and the full post_content, post_author, and post_name of unpublished draft, private, and pending courses via the unrestricted SELECT * fallback query. Exploitation requires supplying both c_status=all (to bypass the publish-only post_status WHERE clause) and return_type=json (to prevent the safe DISTINCT(ID) AS ID field override) in a single unauthenticated request to the /wp-json/lp/v1/courses/archive-course endpoint.