CVE-2026-86449 — LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unaut…
Published: 2026-09-16 · CVSS: 5.3 · CVSS 3.1
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7