{"id":"CVE-2026-115597","kind":"vulnerability","aliases":["CVE-2026-115597"],"related":[],"title":"LearnPress WordPress plugin: missing authorization check exposes protected actions","description":"Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.","summary":"LearnPress, a WordPress learning-management plugin by ThimPress, has a missing authorization check in versions through 4.4.11. A user may be able to perform actions their role should not allow.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["learnpress","package","self-hosted","wordpress"],"not_affected_if":["learnpress-not-installed"],"how_to_check":"- Check the installed LearnPress version in the WordPress admin plugins list, or with `wp plugin get learnpress --field=version`\n- Compare the version against the fixed release in the vendor advisory, which the sources do not give","fix":"- Update LearnPress to a release newer than `4.4.11`, the first fixed version is unknown from the sources\n- If no fixed release exists yet, restrict who can hold LearnPress instructor or course-management roles","status":"open","published_at":"2026-10-26T17:17:16+00:00","first_seen_at":"2026-10-26T17:31:21+00:00","triaged_at":"2026-10-26T17:33:25+00:00","updated_at":"2026-10-26T17:33:25+00:00","category":"package","confidence":0.45,"triage":{"at":"2026-10-26T17:33:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update LearnPress to a release newer than `4.4.11`, the first fixed version is unknown from the sources\n- If no fixed release exists yet, restrict who can hold LearnPress instructor or course-management roles","reach":"internet","title":"LearnPress WordPress plugin: missing authorization check exposes protected actions","impact":"medium","summary":"LearnPress, a WordPress learning-management plugin by ThimPress, has a missing authorization check in versions through 4.4.11. A user may be able to perform actions their role should not allow.","category":"package","nicknames":[],"who_cares":["wordpress","learnpress","self-hosted"],"confidence":0.45,"needs_auth":"unknown","worst_case":"unauthorized users may perform restricted course or site actions","analyst_note":"Find the vendor advisory or patched version and the affected endpoint from the NVD page, since the description is generic.","how_to_check":"- Check the installed LearnPress version in the WordPress admin plugins list, or with `wp plugin get learnpress --field=version`\n- Compare the version against the fixed release in the vendor advisory, which the sources do not give","needs_analyst":true,"not_affected_if":["learnpress-not-installed"],"who_is_affected":"Sites running LearnPress 4.4.11 or earlier on WordPress. The sources do not say which roles or endpoints are reachable, so the exact exposure is unknown. Sites that do not run LearnPress can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000602,"input_tokens":3300,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115597':12A,15A '-2026':11A,14A '4.4.11':39B,74C 'abl':44B 'access':64C 'action':9A,47B 'affect':69C 'allow':52B,60C 'author':5A,34B,54C 'check':6A,35B 'configur':63C 'control':65C 'cve':10A,13A 'exploit':61C 'expos':7A 'host':20B 'incorrect':62C 'issu':68C 'learn':26B 'learning-manag':25B 'learnpress':1A,16B,22B,58C,59C,70C 'levels.this':67C 'manag':27B 'may':42B 'miss':4A,33B,53C 'n/a':72C 'packag':17B 'perform':46B 'plugin':3A,28B 'protect':8A 'role':49B 'secur':66C 'self':19B 'self-host':18B 'thimpress':30B,57C 'user':41B 'version':37B 'vulner':55C 'wordpress':2A,21B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running LearnPress 4.4.11 or earlier on WordPress. The sources do not say which roles or endpoints are reachable, so the exact exposure is unknown. Sites that do not run LearnPress can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115597","severity":null,"published_at":"2026-10-26T17:17:16+00:00","modified_at":"2026-10-26T17:17:16+00:00","first_seen_at":"2026-10-26T17:31:21+00:00","fetched_at":"2026-10-26T17:31:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}