CVE-2026-86449

Overview

The LearnPress WordPress plugin (versions prior to 4.4.7) fails to verify user permissions when processing a REST API request that filters courses by status. This flaw lets an unauthenticated user retrieve a list of courses that are draft, pending, private, scheduled, or trashed, exposing unpublished content.

Description

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.

Impact

{'confidentiality': 'Unpublished course data can be exposed to anyone who can hit the vulnerable REST endpoint, potentially revealing sensitive instructional materials or student information.', 'integrity': 'No direct impact on data integrity; the flaw only allows read access.', 'availability': 'No impact on service availability.'}

Remediation

['Upgrade LearnPress to version 4.4.7 or later, where the capability check has been added.', 'If an upgrade is not immediately possible, restrict access to the affected REST routes by applying a firewall rule or using a plugin that blocks unauthenticated REST API calls.', 'Verify that the REST API endpoint `/wp-json/learnpress/v1/courses` is protected by capability checks in your custom code.', 'Regularly audit REST API logs for unexpected requests to the LearnPress endpoints.']

Risk context

The vulnerability is rated medium (CVSS 5.3) with no EPSS data available. While it does not affect availability or integrity, it enables unauthorized disclosure of unpublished course content, which could be sensitive. Prompt patching or access restriction is recommended to prevent data leakage.

Affected products

• LearnPress plugin
• WordPress