CVE-2026-75982 is a Missing Authorization Vulnerability in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. This vulnerability impacts LearnPress versions 4.4.4 and older and is related to the LearnPress create page AJAX action.
This security flaw makes it possible for a logged-in user who has the role of editor and above to alter WordPress options that are not supposed to be changed using this feature. The vulnerability has a CVSS v3.1 score of 4.4 (Medium) and is CWE-862: Missing Authorization.
What Is CVE-2026-75982?
CVE-2026-75982 is a vulnerability in the LearnPress authorization processing. Although the vulnerable code does check for capabilities and nonces, it fails to limit the parameter “field name” to only LearnPress options names.
Therefore, an authenticated user with Editor permissions or above can affect the value of the option of WordPress updated using the vulnerable AJAX function.
The affected product is:
- Vendor: ThimPress
- Product: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Affected versions: 4.4.4 and earlier
- CWE: CWE-862 — Missing Authorization
- CVSS: 4.4 (Medium)
What Is LearnPress WordPress LMS Plugin?
LearnPress is a WordPress plug-in for the development and management of online courses. This plug-in has features to develop a course as well as other features for the management of learning.
The flaw that will be analyzed in this paper relates to a LearnPress admin Ajax function used in the process of developing a page. The WordPress plugin changelog for LearnPress states that 4.4.5 of LearnPress was released on August 22, 2026.
Understanding Missing Authorization (CWE-862)
CWE-862: Missing Authorization describes a situation where an application does not properly verify whether a user is authorized to perform a particular action.
Authentication and authorization are different:
- Authentication: Who is the user?
- Authorization: What is that user allowed to do?
In CVE-2026-75982, the vulnerable functionality checks whether the user has the edit_pages capability and a valid WordPress REST nonce. However, these checks are available to users with Editor-level privileges, while the field_name parameter is not sufficiently restricted to the intended LearnPress options.
How Does CVE-2026-75982 Work?
The vulnerability involves the learnpress creating page AJAX action.
At a high level, the vulnerable process is:
Authenticated Editor+ user → learnpress_create_page → field_name parameter → insufficient option restriction → WordPress option modification
This vulnerability utilizes the past option name to call a Learn Press function, which eventually invokes WordPress’s update option () function. This happens because the option name used is not restricted to only those options that belong specifically to Learn Press. Therefore, an attacker has some control over the options that are going to be updated. The modification, however, can only set the value to a positive integer for a page ID.
Vulnerable learnpress creates page AJAX Action
Vulnerability lies in the learn press create page AJAX action. The technical analysis describes LP Admin Ajax create page () as the exploited code path. It checks the capability of the current user to edit pages and the WordPress REST once; however, the provided field name is not validated against an allow-list of Learn Press allowed options.
As a result of updating this option, other WordPress options may be affected aside from those the LearnPress page creation feature was supposed to update. This vulnerability may be used to update certain options like users can register and active plugins options among others.
Affected LearnPress Versions
LearnPress 4.4.4 and all earlier versions are listed in the CVE entry as being affected. There is an updated Learn Press version out after that, namely version 4.4.5, which was published on August 22, 2026, and according to the official WordPress changelog, this version features a security update.
Attack Requirements and Exploitation Conditions
CVE-2026-75982 is not unauthenticated vulnerability.
The attacker needs:
- An authenticated WordPress account
- Editor-level privileges or higher
- Access to the affected LearnPress functionality
The vulnerability is therefore different from a vulnerability that can be exploited by a completely anonymous visitor. The available technical description specifically identifies Editor+ authenticated users as the relevant attacker level.
The issue can nevertheless be significant because an Editor-level account should not normally be able to arbitrarily modify unrelated site-wide WordPress options.
Important Accuracy Point
CVE-2026-75982 must be identified as a Missing Authorization vulnerability rather than as an unauthenticated or Remote Code Execution vulnerability.
The problem that has been identified is the capability of an authenticated Editor to make unauthorized changes to WordPress options using LearnPress page creation feature.
Recommended fix: Update LearnPress from 4.4.4 or earlier to 4.4.5 or later. The official WordPress plugin changelog records the security fix in version 4.4.5.
CVSS Score and Severity of CVE-2026-75982
- CVSS v3.1 Base Score: 4.4 (MEDIUM)
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Severity Rating: Medium
- Vulnerability Type: Missing Authorization / Improper Access Control (Limited Option Update)
- Affected Software: Learn Press – WordPress LMS Plugin
- Affected Versions: Versions <= 4.4.4
Impact of CVE-2026-75982
CVE-2026-75982 is a missing authorization flaw in the LearnPress plugin for WordPress. The vulnerability arises due to insufficient access control checks when updating settings via the field_name parameter.
The operational impacts include:
- Unauthorized Option Modification: Authenticated users with limited administrative roles (such as Editors) can modify specific internal plugin options or configuration settings.
- Configuration Tampering: Threat actors can alter course management settings, modifying how specific fields or site options operate within the LMS plugin.
- Low System Risk: The vulnerability does not allow direct unauthenticated access, remote code execution (RCE), or arbitrary database dumping; its impact is limited to unauthorized option updates by authorized roles.
How to Fix CVE-2026-75982
- Upgrade LearnPress Plugin: Update the LearnPress plugin to version 4.4.5 or the latest available patched release via the WordPress Admin Dashboard.
- Review User Privileges: Audit user accounts on the WordPress site and restrict high-level roles (Editor, Instructor, Administrator) to trusted personnel only.
- Verify Installation: Ensure plugin files are updated across all staging and production environments to clear legacy vulnerable controller functions.
Frequently Asked Questions (FAQs)
Conclusion
The CVE-2026-75982 is an authorization vulnerability that occurs in LearnPress LMS Plugin for WordPress. Even though the vulnerability exploits need authentication on the website, the website administrator needs to update his plugin to avoid any vulnerabilities that may occur through unauthorized option modification.
