PT-2026-3534 · WordPress · Learnpress

Andrea Bocchetti · Publicado 2026-01-20 · Atualizado 2026-01-20 · CVE-2025-14798

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin versions prior to 4.3.2.5

Description The LearnPress WordPress LMS Plugin is affected by a sensitive information disclosure issue. Unauthenticated attackers can extract sensitive data, including user first names, last names, social profile links, and enrollment information, through the get item permissions check function.

Recommendations Update LearnPress – WordPress LMS Plugin to version 4.3.2.5 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14798

Produtos afetados

Learnpress

Referências · 6

• https://twitter.com/VulmonFeeds/status/2013470219830739388 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14798 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.1/inc/jwt/rest-api/version1/class-lp-rest-users-v1-controller.php#L134 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/6fb00ce4-aa82-4479-b7f6-79e7bde098c1?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.1/inc/jwt/rest-api/version1/class-lp-rest-users-v1-controller.php#L35 · Nota
• https://twitter.com/CVEnew/status/2013465825395552589 · Publicação no Twitter