CVE-2026-107744 Details
Description
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns.
A vulnerability exists in the LearnPress WordPress LMS Plugin for Create and Sell Online Courses, affecting all versions through 4.4.10. The issue stems from the plugin's failure to properly verify user authorization, enabling authenticated attackers with subscriber-level access or higher to enumerate the entire user roster of the site. This exploitation allows for the extraction of full email addresses from any WordPress account, including those of administrators, by character-by-character analysis of the search response, which serves as an oracle against the user_login and user_email columns.
Users are advised to update the LearnPress WordPress LMS Plugin to version 4.4.11 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LearnPress | <= 4.4.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |