medium5.3
CVE-2026-78125
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2,…
Impact
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.
Affected products
| Product | Affected versions |
|---|---|
| LearnPress WordPress Plugin | before 4.0.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.