CVE-2026-78125: LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LearnPress (WordPress plugin)to a version that resolves this vulnerability.Fixed in 4.0.3
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can query the affected REST endpoint. No WordPress account or authorization is required.
What information can be exposed?
An attacker can disclose the payment status of arbitrary LearnPress orders by enumerating order identifiers.
Which installations are affected?
LearnPress versions through 4.0.2 are affected. Version 4.0.3 is identified as the version containing the authorization fix.
What is the immediate mitigation?
Update the LearnPress WordPress plugin to version 4.0.3 or later. The available information does not identify an alternative configuration-based mitigation.