rootpwn

medium · CVSS v3 6.5 · EPSS 0.0025

CVE-2026-107744

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authoriza…

Description

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns.

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
—
EPSS
0.0025

← All CVEs

Related CVEs

medium

CVE-2026-97314

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.

View analysis

medium

CVE-2026-107763

The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file.

View analysis

medium

CVE-2026-107752

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

View analysis

medium

CVE-2026-109369

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves and arbitrary other users edit access to every booking form on the site by overwriting the user_permission meta that governs the plugin's own access-control list. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to 'read' (making the edit page accessible) and allows them to harvest a valid wpbs_edit_form nonce that will pass validation against any other form_id.

View analysis