CVE-2026-86448 — LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing un…
Published: 2026-09-16 · CVSS: 3.7 · CVSS 3.1
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email addresses.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7