PT-2026-21374 · WordPress+1 · Learnpress Export Import+2

Os + 1 · Published 2026-02-21 · Updated 2026-02-22 · CVE-2026-1787

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions LearnPress Export Import versions up to and including 4.1.0

Description The LearnPress Export Import WordPress extension for the LearnPress plugin is affected by a flaw that allows unauthorized data loss. A missing capability check within the delete migrated data() function permits unauthenticated attackers to delete courses migrated from Tutor LMS. The Tutor LMS plugin must be installed and activated for exploitation to occur.

Recommendations Versions prior to 4.1.1 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1787

Affected Products

Learnpress

Learnpress Export Import

Tutor Lms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1787 · Security Note
• https://t.me/CVEtracker/45378 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2025211337886855640 · Twitter Post
• https://twitter.com/CVEnew/status/2025425468112109875 · Twitter Post
• https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.0/inc/Migration/Controllers/TutorMigrationController.php#L55 · Note
• https://t.me/cveNotify/152719 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3458589 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7bde915d-092a-452b-a0e0-ce5c2ce203dc?source=cve · Note