CVE-2026-107744: LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both userlogin and useremail columns.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. No user interaction is required, and the attack can be performed remotely.
What information can an attacker obtain?
The attacker can enumerate the site's complete WordPress user roster and derive full email addresses for accounts, including administrator accounts. The search response can be used as an oracle against both the user_login and user_email fields.
How can I determine whether my site is affected?
Sites running LearnPress version 4.4.10 or earlier are affected according to the available data. Review the installed LearnPress version and assess whether untrusted or low-privileged users can obtain authenticated Subscriber-level accounts.