Medium severity · published Jun 17, 2026
CVE-2026-8383
LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API
5.3
CVSS
7.6%
EPSS
No
On KEV
Description
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.6% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
LearnPress ·
before 4.3.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8383
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8383
wpscan.com
https://wpscan.com/vulnerability/b7cbf68b-62c5-4787-b84b-69df9e0122b2/
More from LearnPress
7.1
CVE-2026-86444
LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter
7.1
CVE-2026-12970
LearnPress < 4.4.1 - Reflected XSS via c_search
6.5
CVE-2026-12976
LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant
6.1
CVE-2023-5558
LearnPress < 4.2.5.5 - Reflected Cross-Site Scripting
5.3
CVE-2026-86449
LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API