WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

learnpress · Missing authorization · CWE-862

Affectedlearnpress

FixUpdate to 4.4.12 or newer

PublishedOct 26, 16:43 · Patchstack

ScoredOct 26 · 5.4 · Patchstack

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:09 UTC

What we know

No known exploitation. CISA KEV, checked 22:09 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

Description

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

From Patchstack

Affected and fixed versions

ProductAffectedFixed inlearnpressearlier versions4.4.12

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-11-broken-access-control-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in learnpress

All 26 →

5.4WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability · CVE-2026-42690Oct 29 7.5WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability · CVE-2026-115599Oct 29 5.3WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability · CVE-2026-115598Oct 26