PT-2026-21374 · WordPress+1 · Learnpress Export Import+2

Os + 1 · Publicado 2026-02-21 · Atualizado 2026-02-22 · CVE-2026-1787

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions LearnPress Export Import versions up to and including 4.1.0

Description The LearnPress Export Import WordPress extension for the LearnPress plugin is affected by a flaw that allows unauthorized data loss. A missing capability check within the delete migrated data() function permits unauthenticated attackers to delete courses migrated from Tutor LMS. The Tutor LMS plugin must be installed and activated for exploitation to occur.

Recommendations Versions prior to 4.1.1 should be updated.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1787

Produtos afetados

Learnpress

Learnpress Export Import

Tutor Lms

Referências · 8

• https://t.me/CVEtracker/45378 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2025211337886855640 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2025425468112109875 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.0/inc/Migration/Controllers/TutorMigrationController.php#L55 · Nota
• https://t.me/cveNotify/152719 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/3458589 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1787 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/7bde915d-092a-452b-a0e0-ce5c2ce203dc?source=cve · Nota