CVE-2026-107744: LearnPress WordPress Plugin Auth Bypass

CVE-2026-107744 Overview

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses contains an authorization bypass vulnerability affecting all versions up to and including 4.4.10. The flaw allows authenticated attackers with subscriber-level access to enumerate the full WordPress user roster and extract the complete email address of any account, including administrators. Attackers abuse an AJAX search handler as an oracle, probing both the user_login and user_email columns character-by-character. The weakness is classified as Missing Authorization [CWE-862].

Critical Impact

Any logged-in subscriber can harvest administrator usernames and email addresses, providing high-quality targets for credential stuffing, phishing, and password reset abuse against WordPress sites running LearnPress.

Affected Products

• LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• All versions up to and including 4.4.10
• WordPress sites allowing subscriber-level registration with LearnPress enabled

Discovery Timeline

• 2026-10-17 - CVE-2026-107744 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-107744

Vulnerability Analysis

The vulnerability resides in the LearnPress administrative AJAX handler located in inc/admin/class-lp-admin-ajax.php. The handler exposes a user search endpoint that queries both the user_login and user_email columns in the WordPress users table. The endpoint fails to verify that the calling user holds the capability required to perform administrative lookups. Any authenticated session, including a self-registered subscriber, can invoke the endpoint and receive match data in the response.

Because the response reflects whether a supplied substring matches an existing login or email, the endpoint functions as a confirmation oracle. An attacker iterates over characters and progressively confirms each position of a target email address. Enumerating the administrator email is deterministic and completes in a bounded number of requests.

Root Cause

The root cause is a missing capability check in the AJAX action registered by LearnPress. The handler should call current_user_can() with an administrative capability such as manage_options or list_users before executing the user query. The vendor changeset for class-lp-admin-ajax.php adds the missing authorization gate on the affected action.

Attack Vector

Exploitation requires an authenticated session but no elevated privileges. On WordPress sites that permit open registration or on LearnPress sites where students self-enroll, the attacker simply creates an account. The attacker then issues AJAX POST requests to the vulnerable handler, varying the search term each iteration. By observing which queries return a non-empty response, the attacker reconstructs user logins and full email addresses one character at a time. No user interaction and no social engineering is required.

For the vulnerable code paths and vendor remediation, review the LearnPress AJAX Handler Code, the LearnPress Request Handler Code, and the LearnPress Code Changeset.

Detection Methods for CVE-2026-107744

Indicators of Compromise

• Bursts of admin-ajax.php POST requests from a single authenticated subscriber session referencing a LearnPress admin action.
• Repetitive requests whose search parameter increments one character at a time (a, ab, abc).
• Sudden spike in authenticated requests originating from recently created low-privilege accounts.
• Access patterns targeting the handler across sequential alphabetic or numeric payloads over short time windows.

Detection Strategies

• Alert when a single authenticated session issues more than a defined threshold of requests to admin-ajax.php with a LearnPress action parameter within a short interval.
• Baseline normal AJAX usage per role; subscribers invoking admin-scoped AJAX actions should be treated as anomalous.
• Correlate newly registered accounts with immediate high-volume AJAX activity to identify enumeration behavior.

Monitoring Recommendations

• Centralize WordPress access logs and parse admin-ajax.php requests with the action and user ID enriched for query.
• Monitor wp_users reads via database audit logging where supported by the hosting stack.
• Track creation of new subscriber accounts followed by elevated AJAX traffic within the same session.

How to Mitigate CVE-2026-107744

Immediate Actions Required

• Update the LearnPress plugin to a version later than 4.4.10 that includes the capability check added in the vendor changeset.
• Audit WordPress user accounts and remove unknown or dormant subscriber accounts created during the exposure window.
• Rotate administrator email addresses or enforce password resets for accounts whose emails may have been enumerated.
• Enable multi-factor authentication for all administrator and editor accounts to blunt follow-on credential attacks.

Patch Information

The vendor remediated the issue in the LearnPress codebase through changeset 3750011, which modifies inc/admin/class-lp-admin-ajax.php to enforce an authorization check on the affected AJAX action. Site owners should install the fixed release published after version 4.4.10. Review the Wordfence Vulnerability Report for the vendor-published fixed version.

Workarounds

• Disable open user registration under Settings > General until the plugin is upgraded.
• Deploy a web application firewall rule that blocks subscriber-level sessions from invoking LearnPress admin AJAX actions.
• Temporarily deactivate the LearnPress plugin on sites that cannot immediately apply the vendor update.

# Configuration example: block subscribers from the vulnerable AJAX action at the WAF
# Pseudocode rule — adapt to your WAF syntax
if request.uri contains "/wp-admin/admin-ajax.php"
   and request.post.action matches "^learn-press-"
   and session.role == "subscriber"
then deny