rootpwn

high · CVSS v3 7.5

CVE-2026-86445

The LearnPress WordPress plugin (prior to 4.4.7) lacks proper capability checks in an admin template handler, enabling unauthenticated users

Overview

The LearnPress WordPress plugin (prior to 4.4.7) lacks proper capability checks in an admin template handler, enabling unauthenticated users to read all published quiz questions and perform keyword searches on them. This flaw exposes quiz content that should remain private to site administrators and instructors.

Description

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.

Impact

Unauthenticated attackers can gain confidentiality of quiz data (text, identifiers, types) that is intended to be restricted to authorized users. No integrity or availability impact is reported.

Remediation

['Upgrade LearnPress to version 4.4.7 or later, which includes the missing capability checks.', "Verify that the plugin’s admin templates are protected by proper capability checks (e.g., current_user_can('manage_options')).", 'If the plugin is not required, consider disabling or uninstalling it to eliminate the risk.', 'Regularly review plugin updates and security advisories for WordPress plugins.']

Risk context

High severity (CVSS v3 7.5) indicates significant potential for data leakage. Although no EPSS score is available, the flaw permits unauthenticated disclosure of sensitive quiz content, warranting prompt patching.

Affected products

  • LearnPress WordPress plugin

Scores

Severity
high
CVSS v2
6.4
CVSS v3
7.5
CVSS v4
—
EPSS
—

WordPress LearnPress information-disclosure unauthenticated plugin quiz-data confidentiality

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis