CVE-2026-75982 Overview
CVE-2026-75982 is a broken access control vulnerability in the LearnPress plugin for WordPress affecting versions up to and including 4.4.4. The flaw resides in the learnpress_create_page AJAX action, which fails to restrict the field_name parameter to a learn_press_* allow-list before using it as an option key. Authenticated users with Editor-level access or higher can invoke the handler and modify arbitrary WordPress options to a positive integer value. This missing authorization issue is tracked as [CWE-862].
Critical Impact
An authenticated Editor can flip users_can_register to open public registration, corrupt active_plugins to break the site, or tamper with site-wide settings normally reserved for administrators.
Affected Products
- LearnPress plugin for WordPress, versions up to and including 4.4.4
- WordPress sites granting Editor-level roles to untrusted users
- Multi-author WordPress installations running LearnPress
Discovery Timeline
- 2026-08-25 - CVE-2026-75982 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-75982
Vulnerability Analysis
The vulnerability lives in LP_Admin_Ajax::create_page(), the handler wired to the learnpress_create_page AJAX action. The handler performs only two checks: an edit_pages capability check and a wp_rest nonce check. Both artifacts are available to WordPress Editors by default. The handler then reads the field_name request parameter and passes it directly to LP_Helper::create_page(), which invokes update_option($key_option, $page_id).
Because field_name is never validated against an allow-list of learn_press_* option keys, an attacker can supply any WordPress option name. The resulting write sets that option to a positive integer corresponding to a newly created page ID.
Root Cause
The root cause is missing authorization and missing input restriction on a privileged sink. The plugin trusts any user with edit_pages to select the option key written by update_option(). WordPress reserves site-wide options such as users_can_register, active_plugins, template, and stylesheet for administrators, but the plugin does not enforce that boundary.
Attack Vector
An authenticated attacker with Editor-level privileges sends a POST request to admin-ajax.php invoking the learnpress_create_page action. The request supplies a valid wp_rest nonce and a field_name value naming a sensitive core option. The handler creates a page, retrieves the new page ID, and writes it into the attacker-chosen option. Overwriting users_can_register with a positive integer enables public registration. Overwriting active_plugins produces an invalid array and disables site plugins, including security controls.
No verified public exploit code is available. See the Wordfence Vulnerability Report and the LearnPress Code Changeset for the corrected handler logic.
Detection Methods for CVE-2026-75982
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action=learnpress_create_page originating from non-administrator sessions.
- Unexpected changes to the users_can_register option or a sudden increase in new user registrations.
- Corruption or reset of the active_plugins option and unexplained deactivation of security plugins.
- New WordPress pages created in bursts, each correlated with a modification to a core option in wp_options.
Detection Strategies
- Audit the wp_options table for unexpected integer values in options that normally hold strings, arrays, or booleans.
- Enable WordPress audit logging to capture update_option events and correlate them with the initiating user role.
- Review admin-ajax.php access logs for the learnpress_create_page action invoked by users other than administrators.
Monitoring Recommendations
- Alert on any modification to users_can_register, active_plugins, template, stylesheet, siteurl, or home outside of change windows.
- Monitor for Editor accounts issuing AJAX requests that write to wp_options, which is not part of normal editorial workflow.
- Track plugin version drift across managed WordPress fleets to identify sites still running LearnPress 4.4.4 or earlier.
How to Mitigate CVE-2026-75982
Immediate Actions Required
- Update the LearnPress plugin to a version later than 4.4.4 that includes the vendor patch.
- Review all Editor and higher-privileged accounts and remove access for users who no longer require it.
- Verify users_can_register, active_plugins, and other critical options match expected values.
- Rotate credentials for any account that could have invoked the vulnerable endpoint during the exposure window.
Patch Information
The vendor addressed the issue by restricting the field_name parameter to a learn_press_* allow-list before it reaches LP_Helper::create_page(). Review the LearnPress Code Changeset and the affected files at class-lp-admin-ajax.php and class-lp-helper.php for the corrected logic.
Workarounds
- Temporarily deactivate LearnPress on sites that cannot be patched immediately.
- Restrict the edit_pages capability to administrators using a role-management plugin until the update is applied.
- Deploy a Web Application Firewall rule to block requests to admin-ajax.php where action=learnpress_create_page and field_name does not begin with learn_press_.
- Enforce two-factor authentication on all Editor and higher accounts to reduce risk of credential-based exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
