{"api_version":"1","generated_at":"2026-08-25T03:48:40+00:00","cve":"CVE-2026-75982","urls":{"html":"https://cve.report/CVE-2026-75982","api":"https://cve.report/api/cve/CVE-2026-75982.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-75982","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-75982"},"summary":{"title":"LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter","description":"The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.","state":"PUBLISHED","assigner":"Wordfence","published_at":"2026-08-25 03:16:57","updated_at":"2026-08-25 03:16:57"},"problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":[{"version":"3.1","source":"security@wordfence.com","type":"Primary","score":"4.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"4.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","data":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f8b8bfe-8d73-4289-b212-7baf7bceaaf6?source=cve","name":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f8b8bfe-8d73-4289-b212-7baf7bceaaf6?source=cve","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/admin/class-lp-admin-ajax.php#L649","name":"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/admin/class-lp-admin-ajax.php#L649","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/class-lp-helper.php#L264","name":"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/class-lp-helper.php#L264","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/admin/class-lp-admin-ajax.php#L45","name":"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/admin/class-lp-admin-ajax.php#L45","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3659902%40learnpress&new=3659902%40learnpress","name":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3659902%40learnpress&new=3659902%40learnpress","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75982","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75982","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"thimpress","product":"LearnPress – WordPress LMS Plugin for Create and Sell Online Courses","version":"affected 4.4.4 semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-08-18T18:38:00.000Z","lang":"en","value":"Vendor Notified"},{"source":"CNA","time":"2026-08-24T13:28:13.000Z","lang":"en","value":"Disclosed"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Wordfence PRISM","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"LearnPress – WordPress LMS Plugin for Create and Sell Online Courses","vendor":"thimpress","versions":[{"lessThanOrEqual":"4.4.4","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Wordfence PRISM"}],"descriptions":[{"lang":"en","value":"The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators."}],"metrics":[{"cvssV3_1":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-25T02:26:48.639Z","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence"},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f8b8bfe-8d73-4289-b212-7baf7bceaaf6?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/class-lp-helper.php#L264"},{"url":"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/admin/class-lp-admin-ajax.php#L649"},{"url":"https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/admin/class-lp-admin-ajax.php#L45"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3659902%40learnpress&new=3659902%40learnpress"}],"timeline":[{"lang":"en","time":"2026-08-18T18:38:00.000Z","value":"Vendor Notified"},{"lang":"en","time":"2026-08-24T13:28:13.000Z","value":"Disclosed"}],"title":"LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter"}},"cveMetadata":{"assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","assignerShortName":"Wordfence","cveId":"CVE-2026-75982","datePublished":"2026-08-25T02:26:48.639Z","dateReserved":"2026-08-18T18:22:54.382Z","dateUpdated":"2026-08-25T02:26:48.639Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-25 03:16:57","lastModifiedDate":"2026-08-25 03:16:57","problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"75982","Ordinal":"1","Title":"LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Ed","CVE":"CVE-2026-75982","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"75982","Ordinal":"1","NoteData":"The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.","Type":"Description","Title":"LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Ed"}]}}}