CVE-2026-75982 is a critical authorization bypass vulnerability in the WordPress LearnPress LMS plugin that permits unauthenticated remote attackers to execute restricted administrative functions or elevate privileges due to improper permission validation on specific REST API endpoints. Website administrators must immediately upgrade the LearnPress plugin to the latest patched security release, verify administrative user accounts for unauthorized creations, and deploy a Web Application Firewall (WAF) to block malformed API requests.
CVE-2026-75982 is a Missing Authorization Vulnerability in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. This vulnerability impacts LearnPress versions 4.4.4 and older and is related to the LearnPress create page AJAX action.
This security flaw makes it possible for a logged-in user who has the role of editor and above to alter WordPress options that are not supposed to be changed using this feature. The vulnerability has a CVSS v3.1 score of 4.4 (Medium) and is CWE-862: Missing Authorization.
What Is CVE-2026-75982?
CVE-2026-75982 is a vulnerability in the LearnPress authorization processing. Although the vulnerable code does check for capabilities and nonces, it fails to limit the parameter “field name” to only LearnPress options names.
Therefore, an authenticated user with Editor permissions or above can affect the value of the option of WordPress updated using the vulnerable AJAX function.
The affected product is:
- Vendor: ThimPress
- Product: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Affected versions: 4.4.4 and earlier
- CWE: CWE-862 — Missing Authorization
- CVSS: 4.4 (Medium)
What Is LearnPress WordPress LMS Plugin?
LearnPress is a WordPress plug-in for the development and management of online courses. This plug-in has features to develop a course as well as other features for the management of learning.
The flaw that will be analyzed in this paper relates to a LearnPress admin Ajax function used in the process of developing a page. The WordPress plugin changelog for LearnPress states that 4.4.5 of LearnPress was released on August 22, 2026.
Understanding Missing Authorization (CWE-862)
CWE-862: Missing Authorization describes a situation where an application does not properly verify whether a user is authorized to perform a particular action.
Authentication and authorization are different:
- Authentication: Who is the user?
- Authorization: What is that user allowed to do?
In CVE-2026-75982, the vulnerable functionality checks whether the user has the edit_pages capability and a valid WordPress REST nonce. However, these checks are available to users with Editor-level privileges, while the field_name parameter is not sufficiently restricted to the intended LearnPress options.
How Does CVE-2026-75982 Work?
The vulnerability involves the learnpress creating page AJAX action.
At a high level, the vulnerable process is:
Authenticated Editor+ user → learnpress_create_page → field_name parameter → insufficient option restriction → WordPress option modification
This vulnerability utilizes the past option name to call a Learn Press function, which eventually invokes WordPress’s update option () function. This happens because the option name used is not restricted to only those options that belong specifically to Learn Press. Therefore, an attacker has some control over the options that are going to be updated. The modification, however, can only set the value to a positive integer for a page ID.
Vulnerable learnpress creates page AJAX Action
Vulnerability lies in the learn press create page AJAX action. The technical analysis describes LP Admin Ajax create page () as the exploited code path. It checks the capability of the current user to edit pages and the WordPress REST once; however, the provided field name is not validated against an allow-list of Learn Press allowed options.
As a result of updating this option, other WordPress options may be affected aside from those the LearnPress page creation feature was supposed to update. This vulnerability may be used to update certain options like users can register and active plugins options among others.
Affected LearnPress Versions
LearnPress 4.4.4 and all earlier versions are listed in the CVE entry as being affected. There is an updated Learn Press version out after that, namely version 4.4.5, which was published on August 22, 2026, and according to the official WordPress changelog, this version features a security update.
Attack Requirements and Exploitation Conditions
CVE-2026-75982 is not unauthenticated vulnerability.
The attacker needs:
- An authenticated WordPress account
- Editor-level privileges or higher
- Access to the affected LearnPress functionality
The vulnerability is therefore different from a vulnerability that can be exploited by a completely anonymous visitor. The available technical description specifically identifies Editor+ authenticated users as the relevant attacker level.
The issue can nevertheless be significant because an Editor-level account should not normally be able to arbitrarily modify unrelated site-wide WordPress options.
Important Accuracy Point
CVE-2026-75982 must be identified as a Missing Authorization vulnerability rather than as an unauthenticated or Remote Code Execution vulnerability.
The problem that has been identified is the capability of an authenticated Editor to make unauthorized changes to WordPress options using LearnPress page creation feature.
Recommended fix: Update LearnPress from 4.4.4 or earlier to 4.4.5 or later. The official WordPress plugin changelog records the security fix in version 4.4.5.
CVSS Score and Severity of CVE-2026-75982
- CVSS v3.1 Base Score: 4.4 (MEDIUM)
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Severity Rating: Medium
- Vulnerability Type: Missing Authorization / Improper Access Control (Limited Option Update)
- Affected Software: Learn Press – WordPress LMS Plugin
- Affected Versions: Versions <= 4.4.4
Impact of CVE-2026-75982
CVE-2026-75982 is a missing authorization flaw in the LearnPress plugin for WordPress. The vulnerability arises due to insufficient access control checks when updating settings via the field_name parameter.
The operational impacts include:
- Unauthorized Option Modification: Authenticated users with limited administrative roles (such as Editors) can modify specific internal plugin options or configuration settings.
- Configuration Tampering: Threat actors can alter course management settings, modifying how specific fields or site options operate within the LMS plugin.
- Low System Risk: The vulnerability does not allow direct unauthenticated access, remote code execution (RCE), or arbitrary database dumping; its impact is limited to unauthorized option updates by authorized roles.
How to Fix CVE-2026-75982
- Upgrade LearnPress Plugin: Update the LearnPress plugin to version 4.4.5 or the latest available patched release via the WordPress Admin Dashboard.
- Review User Privileges: Audit user accounts on the WordPress site and restrict high-level roles (Editor, Instructor, Administrator) to trusted personnel only.
- Verify Installation: Ensure plugin files are updated across all staging and production environments to clear legacy vulnerable controller functions.
To ensure round-the-clock infrastructure availability, proactive security hardening, and rapid vulnerability patching, partnering with proactive server management and security support safeguards servers against unauthorized access and operational downtime.
Frequently Asked Questions
What causes CVE-2026-75982?
The flaw is caused by missing authorization validation on the field_name parameter, allowing authenticated users with Editor-level access to update limited WordPress options without proper permissions.
Is CVE-2026-75982 exploitable by unauthenticated attackers?
No. Exploitation requires authentication with an existing user account possessing Editor-level or higher permissions on the target WordPress site.
Can this vulnerability lead to Remote Code Execution (RCE)?
No. The scope is limited to option modifications within the plugin’s configuration parameters and does not grant arbitrary code execution capabilities.
How can server administrators monitor and detect exploitation attempts targeting CVE-2026-75982?
Administrators should inspect web server access logs for anomalous payload patterns, enable intrusion detection systems (IDS/IPS), and set up automated alert triggers on unexpected process executions.
What server-level security configurations minimize the impact of CVE-2026-75982?
Enforcing strict least-privilege service accounts, isolating application tiers in separate containers, and configuring a robust Web Application Firewall (WAF) significantly mitigates exploitation risks.
Conclusion: Mitigating Security Risks for CVE-2026-75982
Addressing critical vulnerabilities like CVE-2026-75982 requires a proactive defense-in-depth posture. Promptly installing security patches for LearnPress Plugin Authorization, auditing user permissions, and monitoring server error logs are vital for preventing unauthorized access.
Securing your web applications on hardened, professionally managed server infrastructure guarantees continuous protection against evolving cyber threats. Explore Onlive Server secure VPS and dedicated server hosting for enterprise-grade defense.
For optimal speed and reliable uptime, deploy your projects on Onlive Server high-performance Linux VPS powered by NVMe Gen4 storage and KVM virtualization.
