CVE-2026-86449 — LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API

CVE-2026-86449

LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API PUBLISHED

Description (CNA)

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.

Affected (CNA)

Vendor / product	Versions
Unknown / LearnPress	affected 4.2.7.1 before 4.4.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1c085889-fa9d-4827-8ff3-3b1d48fb2681/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.