REST API Vulnerability in LearnPress Plugin by WordPress
CVE-2026-78125
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 27 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-78125?
A critical vulnerability in the LearnPress WordPress plugin allows unauthorized attackers to access sensitive information. This flaw exists in the plugin's REST API, where no authorization checks are performed on certain endpoints. As a result, attackers can exploit this weakness to disclose the payment status of any order by simply enumerating order identifiers, potentially exposing sensitive financial information to malicious actors.
Affected Version(s)
LearnPress 0 < 4.0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.