Sensitive Information Exposure in LearnPress Plugin for WordPress
CVE-2025-14798

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Learnpress – WordPress Lms Plugin For Create And Sell Online Courses
Vendor
CVE Published:
20 January 2026

What is CVE-2025-14798?

The LearnPress WordPress LMS Plugin is susceptible to a vulnerability that enables unauthenticated attackers to access sensitive user information. This includes personal details such as first names, last names, and links to social profiles, as well as enrollment data. The issue arises from flaws in the get_item_permissions_check function within versions up to and including 4.3.2.4, highlighting the importance of timely updates and rigorous security measures to protect user data.

Affected Version(s)

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses 0 <= 4.3.2.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/learnpress/tag...
https://plugins.trac.wordpress.org/browser/learnpress/tag...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

andrea bocchetti
.