Unauthorized Modification in LearnPress Plugin for WordPress
CVE-2026-75982

4.4MEDIUM

Key Information:

Vendor

WordPress
Status
Learnpress – WordPress Lms Plugin For Create And Sell Online Courses
Vendor
CVE Published:
25 August 2026

What is CVE-2026-75982?

The LearnPress plugin for WordPress allows authenticated attackers with Editor-level access and above to exploit a flaw in the learnpress_create_page AJAX action. By leveraging insufficient validation, attackers can modify arbitrary WordPress options, such as enabling public registration or corrupting active plugin settings, thereby compromising the site's integrity and functionality.

Affected Version(s)

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses 0 <= 4.4.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/learnpress/tru...
https://plugins.trac.wordpress.org/browser/learnpress/tru...

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.