Executive brief
The LearnPress plugin for WordPress, which is used to create and manage online courses, contains a security flaw that allows unauthorized visitors to view sensitive information about the site's users. An attacker can access details such as user roles, administrative permissions, and registration dates. This information could be used to identify high-privileged accounts for further targeted attacks.
Technical details
The LearnPress plugin before version 4.3.7 suffers from a missing authorization vulnerability (CWE-862) within its REST API implementation. Specifically, the plugin does not verify the 'edit_users' capability when the 'edit' context is requested on the 'learnpress/v1/users' endpoint. An unauthenticated remote attacker can exploit this by sending a crafted GET request with the 'context=edit' parameter. Successful exploitation allows the attacker to retrieve sensitive metadata for all returned users, including their roles, full capabilities map, extra capabilities, locale, and registration dates. This bypasses the standard security controls typically enforced by WordPress core for user data.
Affected products
- LearnPress LearnPress < 4.3.7
Timeline
- 2026-05-27: disclosed: Publicly published via WPScan
- 2026-06-17: advisory: NVD published date
- 2026-06-17: patched: Fixed in version 4.3.7