Live › vulnerability › CVE-2026-42690
LearnPress, a WordPress learning-management plugin, has a broken access control flaw affecting versions up to and including 4.4.10. A logged-in user with the Subscriber role can perform actions they should not be allowed to, per the NVD description.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running LearnPress 4.4.10 or earlier are exposed. The flaw is reachable by a logged-in user with the Subscriber role, so sites that allow open sign-up or have many subscriber accounts carry more risk. Sites without LearnPress, or running a newer version, can skip it.
No product ranges from the sources yet.
wp-content/plugins/learnpress/4.4.10 are affected; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-42690")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.