Unauthorized Data Deletion in LearnPress Export Import Plugin for WordPress
CVE-2026-1787

4.8MEDIUM

Key Information:

Vendor

WordPress
Status
Learnpress – Backup & Migration Tool
Vendor
CVE Published:
21 February 2026

What is CVE-2026-1787?

The LearnPress Export Import plugin for WordPress has a vulnerability that allows unauthorized users to delete migrated course data due to a lack of capability checks in the 'delete_migrated_data' function. This issue impacts all versions up to and including 4.1.0, and requires the Tutor LMS plugin to be installed and activated for successful exploitation. Attackers can exploit this vulnerability to manipulate data integrity, posing significant risks to course content and user trust.

Affected Version(s)

LearnPress – Backup & Migration Tool 0 <= 4.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/learnpress-imp...
https://plugins.trac.wordpress.org/changeset/3458589/

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Osvaldo Noe Gonzalez Del Rio
.