CVE-2026-86449: LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API

Q: Who can exploit this issue?

Any unauthenticated attacker can exploit it because the affected REST route does not verify user capabilities before applying a supplied post-status filter.

Q: What information can be exposed?

Attackers can list courses that are not published, including courses in draft, pending, private, scheduled, and trashed states.

Q: Which installations are affected?

LearnPress versions before 4.4.7 are affected.

Published Sep 16, 2026

Updated

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.

Affected Software

1 affected component

LearnPress<4.4.7

Event History

Sep 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated attacker can exploit it because the affected REST route does not verify user capabilities before applying a supplied post-status filter.

What information can be exposed?

Attackers can list courses that are not published, including courses in draft, pending, private, scheduled, and trashed states.

Which installations are affected?

LearnPress versions before 4.4.7 are affected.