Medium severity · published Oct 29, 2026
CVE-2026-42690
WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
New
5.4
CVSS
–
EPSS
No
On KEV
Description
Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
LearnPress · ThimPress
through 4.4.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42690
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42690
vdb-entry
https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-10-broken-access-control-vulnerability-2?_s_id=cve
More from LearnPress
9.8
CVE-2023-36515
WordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerability
9.8
CVE-2024-4434
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection
9.8
CVE-2023-6634
LearnPress <= 4.2.5.7 - Command Injection
9.8
CVE-2022-47615
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions
9.8
CVE-2022-45808
SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions