CVE-2026-115598: WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
Published Oct 26, 2026
·Updated
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.
Affected Software
1 affected component
thimpress LearnPress<=4.4.11
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress LearnPressto a version that resolves this vulnerability.Fixed in 4.4.12
Event History
Oct 26, 2026
CVE Published
via MITRE·04:45 PM
Data Sourced
via MITRE·04:45 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Can this be exploited remotely without an account or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
2
What is the likely impact if exploitation succeeds?
The reported impact is limited to confidentiality: CVSS assigns low confidentiality impact and no integrity or availability impact.
3
Which LearnPress versions are affected?
The issue affects LearnPress versions through 4.4.11. The available data does not identify a fixed version.