Unauthorized Email Notification Trigger in LearnPress WordPress LMS Plugin

CVE-2026-3226

What is CVE-2026-3226?

The LearnPress WordPress LMS Plugin is exposed to a vulnerability that allows authenticated users to trigger arbitrary email notifications due to inadequate capability checks. The issue arises from missing current_user_can() verification on multiple functions in the SendEmailAjax class. Although a wp_rest nonce is utilized, it fails to securely authenticate user permissions before executing handler functions. This oversight opens the door for users with a Subscriber role and higher to abuse this functionality, which could lead to email flooding, social engineering tactics, and impersonation of administrators in correspondence regarding instructor requests.

References