CVE-2026-115599: WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates the issue can be exploited remotely over the network without authentication, prior privileges, or user interaction. Exploitation complexity is rated low.

Q: Which LearnPress installations are affected?

LearnPress versions through 4.4.11 are affected. The affected version range begins at an unspecified earlier version.

Q: What is the expected security impact?

The reported impact is high confidentiality impact, with no reported integrity or availability impact. The CVSS base score is 7.5 (High).

Published Oct 29, 2026

Updated

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

Affected Software

1 affected component

thimpress LearnPress<=4.4.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress LearnPress plugin to a version that resolves this vulnerability.
Fixed in 4.4.12

Event History

Oct 29, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates the issue can be exploited remotely over the network without authentication, prior privileges, or user interaction. Exploitation complexity is rated low.

Which LearnPress installations are affected?