CVE-2026-86447: LearnPress WordPress Information Disclosure

CVE-2026-86447 Overview

CVE-2026-86447 is an information disclosure vulnerability in the LearnPress WordPress plugin before version 4.4.7. The plugin fails to verify user capabilities in one of its administrative course tools. Unauthenticated attackers can enumerate every enrolled student's display name and user identifier for a given course. Attackers can also recover student email addresses through the same handler's search filter. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can harvest personally identifiable information (PII) of enrolled students, including display names, user IDs, and email addresses, exposing user bases to phishing, credential-stuffing, and targeted social engineering campaigns.

Affected Products

LearnPress WordPress plugin versions prior to 4.4.7
WordPress sites using LearnPress for course delivery and student enrollment
Any deployment relying on LearnPress administrative course tooling for enrolled-user management

Discovery Timeline

2026-09-16 - CVE-2026-86447 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-86447

Vulnerability Analysis

The vulnerability resides in an administrative course tool handler that omits a capability check. WordPress plugins are expected to gate privileged operations behind current_user_can() verification or equivalent nonce and role checks. LearnPress registers the affected endpoint without enforcing these controls. As a result, requests from unauthenticated clients reach code paths intended solely for course administrators.

Once the handler is invoked, it returns enrollment records tied to a specified course. Each record includes the enrolled user's display name and internal user identifier. The handler also exposes a search filter parameter that the plugin uses to query against user attributes, including email addresses. Attackers can iterate the filter to enumerate email values character by character.

Root Cause

The root cause is a missing authorization check on an administrative AJAX or REST handler in LearnPress. The plugin trusts that the endpoint is only reachable from the WordPress admin interface. It does not validate the caller's role or capability before returning enrollment data.

Attack Vector

Exploitation requires only network access to the target site. No authentication, user interaction, or elevated privileges are needed. An attacker sends crafted HTTP requests to the vulnerable handler, supplying a course identifier and optional search filter. The server responds with structured enrollment data that the attacker can parse and aggregate across every course on the site. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-86447

Indicators of Compromise

Repeated unauthenticated requests to LearnPress administrative AJAX or REST endpoints from a single source IP or small IP set
HTTP requests iterating a search or filter parameter across incremental character sequences
Anomalous spikes in admin-ajax.php traffic referencing LearnPress actions from unauthenticated sessions

Detection Strategies

Review web server access logs for unauthenticated POST or GET requests to LearnPress handlers referencing course IDs
Enable WordPress audit logging to capture calls to plugin AJAX actions and correlate against session state
Deploy a web application firewall (WAF) rule that flags high-volume requests to LearnPress endpoints from a single client

Monitoring Recommendations

Alert on outbound enumeration patterns targeting wp-admin/admin-ajax.php with LearnPress-specific action names
Track baseline query volume for the affected handler and alert on deviations exceeding normal administrative activity
Monitor for downstream phishing campaigns targeting email addresses of students enrolled in courses hosted on LearnPress sites

How to Mitigate CVE-2026-86447

Immediate Actions Required

Upgrade the LearnPress WordPress plugin to version 4.4.7 or later on every affected site
Audit web server logs for prior enumeration activity against LearnPress endpoints and preserve evidence
Notify affected students if evidence indicates their PII was harvested and provide phishing awareness guidance

Patch Information

The LearnPress maintainers addressed the missing capability check in version 4.4.7. Administrators should update through the WordPress plugin dashboard or by deploying the latest package from the official plugin repository. Confirm the installed version after upgrade and validate that the affected administrative handler now rejects unauthenticated requests.

Workarounds

Restrict access to wp-admin/admin-ajax.php from untrusted networks using a WAF or reverse proxy access control list
Temporarily disable the LearnPress plugin on sites that cannot be upgraded until the patched version is applied
Add server-level authentication (for example, HTTP basic auth) on administrative WordPress endpoints where feasible

bash

# Configuration example: WAF rule to block unauthenticated LearnPress admin-ajax calls
# ModSecurity example - adjust action names to match LearnPress handlers
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1008644701,\
    msg:'Block unauthenticated LearnPress admin handler access'"
    SecRule ARGS:action "@rx ^learnpress_" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"