Live › vulnerability › CVE-2026-107744
Go to dashboardLearnPress, a WordPress course plugin, does not check user permissions on a search action, so any logged-in subscriber can query user data. An attacker can recover the full email address of any account, including administrators, one character at a time.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running LearnPress 4.4.10 or older where users can hold a subscriber-level account, which includes sites with open registration. Sites that do not use LearnPress, or that only let administrators and editors log in, are not exposed.
No product ranges from the sources yet.
wp plugin get learnpress --field=version4.4.10 (the sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns.
This page as .md · .json · in your agent: get_signal("CVE-2026-107744")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.