← CVE Intelligence

CVE-2026-86448

LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order PUBLISHED

Description (CNA)

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email addresses.

Affected (CNA)

Vendor / productVersions
Unknown / LearnPressaffected 4.3.2.8 before 4.4.7

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.