CVE-2026-86449: LearnPress WordPress Information Disclosure

CVE-2026-86449 Overview

CVE-2026-86449 is an information disclosure vulnerability in the LearnPress WordPress plugin versions prior to 4.4.7. The plugin fails to verify user capabilities before applying a user-supplied post status filter in one of its REST API routes. Unauthenticated attackers can enumerate non-published courses, including draft, pending, private, scheduled, and trashed entries. The flaw maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. While the confidentiality impact is limited to course metadata, the exposure can reveal unpublished educational content, internal drafts, and scheduled releases that site owners intended to keep private.

Critical Impact
Unauthenticated attackers can list non-public LearnPress courses across all post statuses, exposing draft, private, scheduled, and trashed course data through an unauthorized REST route.

Affected Products

LearnPress WordPress plugin versions before 4.4.7
WordPress sites running LearnPress with default REST API endpoints enabled
Learning Management System (LMS) deployments using LearnPress for course delivery

Discovery Timeline

2026-09-16 - CVE-2026-86449 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-86449

Vulnerability Analysis

The vulnerability resides in one of the LearnPress plugin's REST API routes. The route accepts a status filter parameter from the request but does not verify whether the requesting user holds the capability to view posts in the requested status. WordPress conventionally restricts non-published post statuses such as draft, pending, private, scheduled, and trash to authenticated users with appropriate capabilities like edit_posts or read_private_posts. LearnPress passes the attacker-controlled status value directly into the underlying query without this authorization check, returning matching course records to any anonymous caller.

Root Cause

The root cause is a missing capability check ([CWE-200]) between REST parameter parsing and query execution. The REST controller trusts the client-supplied status argument and delegates it to the query layer without invoking current_user_can() or an equivalent permission callback tied to the requested status. Public-by-design read endpoints for published courses were extended with a status filter, but the corresponding authorization gate was not added.

Attack Vector

Exploitation requires only network access to the WordPress REST API. An attacker sends an unauthenticated HTTP GET request to the vulnerable LearnPress REST route and supplies a non-public value for the status parameter. The endpoint returns a JSON list of matching courses regardless of publication state. No user interaction, credentials, or elevated privileges are required. See the WPScan vulnerability analysis for endpoint specifics.

Detection Methods for CVE-2026-86449

Indicators of Compromise

Unauthenticated HTTP GET requests to LearnPress REST API endpoints containing status query parameters set to draft, pending, private, future, or trash.
REST API responses returning course objects whose status field is not publish to clients without valid authentication cookies or nonces.
Anomalous spikes in requests to /wp-json/ paths associated with LearnPress course listings from a single IP or user agent.

Detection Strategies

Inspect web server access logs for /wp-json/lp/ or similar LearnPress REST paths carrying a status parameter with non-default values.
Correlate REST API responses that contain non-published course identifiers with the absence of an authenticated session cookie.
Deploy a Web Application Firewall (WAF) rule that flags unauthenticated requests attempting to filter WordPress content by restricted post statuses.

Monitoring Recommendations

Enable verbose REST API logging on WordPress and forward events to a centralized log platform for retention and query.
Baseline normal REST traffic volume for the LearnPress endpoints and alert on deviations.
Track outbound response sizes from REST endpoints to detect bulk enumeration attempts.

How to Mitigate CVE-2026-86449

Immediate Actions Required

Upgrade the LearnPress plugin to version 4.4.7 or later on every WordPress site in the environment.
Audit REST API access logs for prior enumeration attempts and identify any exposed unpublished course content.
Rotate or take offline any draft courses that contained sensitive material such as unreleased assessments or embargoed content.

Patch Information

The LearnPress maintainers addressed this issue in version 4.4.7 by adding the missing capability check to the affected REST route. Site administrators should update through the WordPress plugin dashboard or by deploying the patched plugin package. Refer to the WPScan advisory for CVE-2026-86449 for verified fix details.

Workarounds

Restrict access to the LearnPress REST API endpoints at the web server or WAF layer until the plugin is upgraded.
Disable the LearnPress plugin on sites that cannot be updated immediately if unpublished course confidentiality is required.
Enforce authentication on /wp-json/ routes for non-published content by using a REST authentication hardening plugin or custom rest_authentication_errors filter.

bash

# Example: block unauthenticated LearnPress REST status filters at nginx
location ~* /wp-json/lp/.*/courses {
    if ($arg_status ~* "draft|pending|private|future|trash") {
        return 403;
    }
}