PT-2026-3534 · WordPress · Learnpress

Andrea Bocchetti · CVE-2025-14798 · Published 2026-01-20 · Updated 2026-01-20

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin versions prior to 4.3.2.5

Description The LearnPress WordPress LMS Plugin is affected by a sensitive information disclosure issue. Unauthenticated attackers can extract sensitive data, including user first names, last names, social profile links, and enrollment information, through the get item permissions check function.

Recommendations Update LearnPress – WordPress LMS Plugin to version 4.3.2.5 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14798

Affected Products

Learnpress

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14798 · Security Note
• https://twitter.com/VulmonFeeds/status/2013470219830739388 · Twitter Post
• https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.1/inc/jwt/rest-api/version1/class-lp-rest-users-v1-controller.php#L134 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6fb00ce4-aa82-4479-b7f6-79e7bde098c1?source=cve · Note
• https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.1/inc/jwt/rest-api/version1/class-lp-rest-users-v1-controller.php#L35 · Note
• https://twitter.com/CVEnew/status/2013465825395552589 · Twitter Post