CVE Intelligence
Skip to main content
mediumAccess Controlpublic exploit

CVE-2026-75982

CVE-2026-75982 — LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.

Published Updated Sources: NVD, thimpress (CNA), GitHub, GitHub Security Advisory, SOCRadar CTI

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Exploit code

public exploit, none observed

EPSS

0%

ahead of 0% of scored CVEs

Affects

thimpress

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

CVSS base

4.4

medium

Remediation

The vendor's own words where we have them.

Upgrade LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to a fixed release. Apply vendor patches per advisory and restrict external exposure of the affected component until patched.

First 24 hours

Ordered from the record's own fields — exposure first, because you cannot patch what you have not found.

  • Identify exposed assets running affected vendor/product/version combinations.
  • Prioritize based on EPSS, PoC availability, and external exposure.
  • Search available logs for exploit probes, errors, authentication anomalies, or suspicious child processes matching the vulnerability class.

Affected scope

Vendor, product and version as the advisories word them.

VendorProductVersionsStatus
thimpressLearnPress – WordPress LMS Plugin for Create and Sell Online Courses0 to <= 4.4.4Vulnerable

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Availability

None

Confidentiality

None

Integrity

High

Scope

Unchanged

Attack Complexity

High

Attack Vector

Network

Privileges Req

High

User Interaction

None

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

ScoreVersionSeverityExpl.ImpactSource
4.4CVSS 3.1medium0.73.6NVD, thimpress (CNA), GHSA

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

What this weakness leads to

MITRE's own consequences and mitigations for the weakness class — the authority's wording, not guidance derived from the CVSS vector.

MITRE

CWE-862 · Missing Authorization

  • Read Application Data
  • Read Files or Directories
  • Modify Application Data
  • Modify Files or Directories

Mitigation: Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

Weakness & attack patterns

  • CWE-862

Inferred from the weakness class — not observed against this CVE.

CAPEC-1 · Accessing Functionality Not Properly Constrained by ACLsCAPEC-122 · Privilege Abuse
  • T1211Exploitation for Defensive Evasion
  • T1542.002Pre-OS Boot: Component Firmware
  • T1556Modify Authentication Process

Public exploit

Capability, not use: code existing is a different claim from anyone running it.

Repositories

1

Detection

Read off the CVSS vector and the weakness class. Starting points, not rules we have tested.

  • Prioritize edge telemetry for network-reachable LearnPress – WordPress LMS Plugin for Create and Sell Online Courses.
  • Monitor for scanner or exploit-pattern traffic after 1 public PoC repositories were reported.
web/proxy/WAF logsapplication logsnetwork IDS/IPS

Timeline

What happened to this CVE, newest first — with the readings a source repeats on a schedule counted underneath rather than listed.

  1. 2026

  2. Added · CVSS 3.1 4.4 (AV:N)

    Aug 25, 2026 · NVD

  3. Initial · CVE published

    Aug 25, 2026 · NVD

  4. Added · GHSA-2qx9-4rjh-4r9j published (medium)

    Aug 25, 2026 · GitHub Security Advisory

  5. Reported · Disclosed

    Aug 24, 2026 · thimpress

  6. Reported · Vendor Notified

    Aug 18, 2026 · thimpress

References

7 on the record

Elsewhere on this site

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record1

What should defenders know first?

CVE-2026-75982 is LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter, a medium vulnerability affecting LearnPress – WordPress LMS Plugin for Create and Sell Online Courses from thimpress. The current evidence does not list it in CISA KEV, and the exploit status is: Active exploitation is not confirmed from current sources for CVE-2026-75982. Public exploit evidence is: 1 public PoC repositories reported; 0 marked weaponized in current dataset. The affected-version evidence is listed in the key facts and affected products tables. Defenders should first verify whether exposed or business-critical assets run those versions, then apply vendor patches or mitigations, restrict reachable attack surface, and preserve logs for detection review. CVSS 4.4 describes technical severity, while EPSS 0% helps estimate near-term exploit likelihood; neither replaces asset context. Unknown fields should remain explicit in tickets, and threat actor, IOC, victimology, or payload claims should not be added unless a cited source supports them. Monitor CISA KEV, vendor advisories, NVD changes, public PoC repositories, and internal telemetry for update triggers.