Junglewise Threat Intelligence

CVE-2026-8502: LearnPress WordPress Plugin Sensitive Information Exposure in REST API

CVE-2026-8502 · Severity: medium · CVSS 5.3 · Published 2026-06-06

Technologies: ThimPress LearnPress. Vendors: ThimPress.

Executive brief

The LearnPress plugin for WordPress, which is used to create and sell online courses, contains a security flaw that allows unauthorized individuals to view hidden information. This includes the passwords for protected courses and the content of unpublished drafts or private courses. An attacker could use this to access proprietary educational material or sensitive internal course data without permission.

Technical details

The LearnPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 4.3.6 due to an unrestricted 'SELECT *' fallback query in the course archive endpoint. By sending an unauthenticated request to '/wp-json/lp/v1/courses/archive-course' with specific parameters ('c_status=all' and 'return_type=json'), an attacker can bypass the default 'publish-only' filter and the 'DISTINCT(ID)' field override. This results in the exposure of sensitive database fields, including 'post_password' for password-protected courses and 'post_content' for draft, private, and pending courses. The vulnerability is rooted in missing authorization checks and improper parameter handling within the REST API controller.

Affected products

  • LearnPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses up to, and including, 4.3.6

Timeline

  • 2026-06-06: disclosed
  • 2026-06-06: advisory

References

Related threats