Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2026-86449 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied…

Description

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.

Produits et versions touchés

Produit Versions touchées Corrigé en
LearnPress 4.2 4.2.7.1 → < 4.4.7 4.4.7

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de LearnPress

Les 17 CVE de LearnPress →
CVE-2026-86446 The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is… 3.7 Faible CVE-2026-86447 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course… 5.3 Moyenne CVE-2026-86448 The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before… 3.7 Faible CVE-2026-86445 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative… 5.3 Moyenne
Suivre cette CVE