Medium severity · published Sep 16, 2026
CVE-2026-86449
LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
LearnPress ·
4.2.7.1 before 4.4.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86449
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86449
wpscan.com
https://wpscan.com/vulnerability/1c085889-fa9d-4827-8ff3-3b1d48fb2681/
More from LearnPress
7.1
CVE-2026-86444
LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter
7.1
CVE-2026-12970
LearnPress < 4.4.1 - Reflected XSS via c_search
6.5
CVE-2026-12976
LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant
5.3
CVE-2026-86447
LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax
5.3
CVE-2026-86445
LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax