Authorization Bypass Vulnerability in LearnPress WordPress LMS Plugin

CVE-2026-107744

What is CVE-2026-107744?

The LearnPress plugin for WordPress is affected by a vulnerability that allows authenticated users with subscriber-level access and above to perform unauthorized actions. This flaw arises from insufficient verification of user permissions, enabling attackers to exploit the plugin's functionality to enumerate the complete user roster of the site. By leveraging search responses as an oracle, malicious actors can extract the full email addresses of all WordPress accounts, including those of administrators, thereby posing a significant risk to user privacy and security.

References