Unauthorized Email Notification Trigger in LearnPress WordPress LMS Plugin

CVE-2026-3226

What is CVE-2026-3226?

The LearnPress WordPress LMS Plugin is exposed to a vulnerability that allows authenticated users to trigger arbitrary email notifications due to inadequate capability checks. The issue arises from missing current_user_can() verification on multiple functions in the SendEmailAjax class. Although a wp_rest nonce is utilized, it fails to securely authenticate user permissions before executing handler functions. This oversight opens the door for users with a Subscriber role and higher to abuse this functionality, which could lead to email flooding, social engineering tactics, and impersonation of administrators in correspondence regarding instructor requests.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References