CVE-2026-1787: LearnPress Auth Bypass Vulnerability

CVE-2026-1787 Overview

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_migrated_data function in all versions up to, and including, 4.1.0. This Missing Authorization vulnerability (CWE-862) makes it possible for unauthenticated attackers to delete courses that have been migrated from Tutor LMS. The Tutor LMS plugin must be installed and activated in order to exploit the vulnerability.

Critical Impact

Unauthenticated attackers can delete migrated course data without any authorization checks, potentially causing significant data loss for WordPress sites using both LearnPress Export Import and Tutor LMS plugins.

Affected Products

• LearnPress Export Import – WordPress extension for LearnPress versions up to and including 4.1.0
• WordPress sites with both LearnPress Export Import and Tutor LMS plugins installed and activated

Discovery Timeline

• 2026-02-21 - CVE CVE-2026-1787 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-1787

Vulnerability Analysis

This vulnerability stems from a Missing Authorization flaw (CWE-862) in the LearnPress Export Import plugin's migration functionality. The delete_migrated_data function within the TutorMigrationController.php file fails to implement proper capability checks before executing data deletion operations. This architectural oversight allows any user, including unauthenticated visitors, to invoke the function and delete course data that was previously migrated from Tutor LMS.

The vulnerability requires a specific configuration where both the LearnPress Export Import plugin and the Tutor LMS plugin are installed and activated on the same WordPress installation. While this prerequisite limits the attack surface somewhat, sites running both plugins in tandem—commonly seen during LMS migration scenarios—are fully exposed to this data destruction attack.

Root Cause

The root cause of this vulnerability is the absence of a WordPress capability check in the delete_migrated_data function located in TutorMigrationController.php. WordPress plugins should implement capability checks using functions like current_user_can() to verify that the requesting user has appropriate permissions before executing sensitive operations. Without this authorization gate, the function can be triggered by any HTTP request, regardless of the requester's authentication status.

Attack Vector

An attacker can exploit this vulnerability remotely over the network without requiring any authentication credentials. The attack involves sending a crafted HTTP request to the WordPress site that triggers the delete_migrated_data function. Since no capability verification occurs, the function executes and deletes migrated course data. The attack requires no user interaction and can be executed against any vulnerable WordPress installation where both the LearnPress Export Import (version ≤ 4.1.0) and Tutor LMS plugins are active.

The vulnerability is documented in the WordPress Tutor Migration Code at line 55, where the delete_migrated_data function lacks the necessary authorization controls. The WordPress Changeset #3458589 contains the patch that addresses this issue.

Detection Methods for CVE-2026-1787

Indicators of Compromise

• Unexpected deletion of courses that were migrated from Tutor LMS
• Web server logs showing unauthenticated POST requests to endpoints related to delete_migrated_data or the migration controller
• Database audit logs indicating course record deletions without corresponding administrative activity
• User reports of missing course content following migration operations

Detection Strategies

• Monitor WordPress access logs for suspicious requests targeting the LearnPress Export Import plugin's migration endpoints
• Implement web application firewall (WAF) rules to flag unauthorized attempts to invoke sensitive plugin functions
• Enable WordPress database query logging to detect unexpected DELETE operations on course-related tables
• Deploy file integrity monitoring on plugin directories to detect unauthorized modifications

Monitoring Recommendations

• Set up alerting for any requests to the TutorMigrationController endpoint from non-administrator sessions
• Review WordPress audit logs regularly for data deletion events that lack corresponding administrator authentication
• Monitor for spikes in 4xx/5xx HTTP responses that may indicate reconnaissance or exploitation attempts
• Implement automated backup verification to ensure course data can be restored if compromised

How to Mitigate CVE-2026-1787

Immediate Actions Required

• Update LearnPress Export Import plugin to a version newer than 4.1.0 that includes the security fix
• If immediate update is not possible, temporarily deactivate either the LearnPress Export Import or Tutor LMS plugin to break the exploitation chain
• Review recent access logs for any signs of exploitation attempts
• Verify the integrity of migrated course data and restore from backups if necessary

Patch Information

A security patch addressing this vulnerability is available in WordPress Changeset #3458589. This changeset adds the missing capability check to the delete_migrated_data function, ensuring that only authorized administrators can execute data deletion operations. WordPress site administrators should update the LearnPress Export Import plugin through the WordPress admin dashboard or by downloading the latest version from the WordPress plugin repository.

For additional technical details about this vulnerability, refer to the Wordfence Vulnerability Report.

Workarounds

• Temporarily deactivate the LearnPress Export Import plugin until the patch can be applied
• If the Tutor LMS plugin is no longer needed, consider removing it to eliminate the exploitation prerequisite
• Implement additional access controls at the web server level to restrict access to WordPress admin endpoints
• Use a WordPress security plugin with capability to block unauthorized function calls

# Temporary workaround: Deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate learnpress-import-export

# After updating, reactivate the plugin
wp plugin update learnpress-import-export
wp plugin activate learnpress-import-export