Executive Summary

CVE-2026-25002 is a broken authentication vulnerability in the WordPress LearnPress – Sepay Payment Plugin versions up to and including 4.0.0.

This vulnerability allows unauthenticated attackers to perform actions typically restricted to higher privileged users, potentially enabling them to gain administrative access to affected websites.

The issue is classified under the OWASP Top 10 category A7: Identification and Authentication Failures.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can bypass authentication controls and perform actions reserved for administrators or other privileged users.

This could lead to unauthorized administrative access to your website, allowing the attacker to modify content, change settings, or potentially compromise sensitive data.

Although the CVSS severity score is 7.5 (high severity), the overall impact is considered low by Patchstack due to unlikely exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is patched in version 4.0.1 of the LearnPress – Sepay Payment Plugin.

Immediate updating to version 4.0.1 or later is strongly recommended to mitigate the risk.

Patchstack users can enable auto-updates specifically for vulnerable plugins to quickly reduce exposure.

Useful 0 Not Useful 0

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-25002 is a broken authentication vulnerability that allows unauthenticated attackers to perform actions typically restricted to higher privileged users, potentially gaining administrative access to affected websites.

Such unauthorized access can lead to exposure or manipulation of sensitive data, which may impact compliance with common standards and regulations like GDPR and HIPAA that require strict access controls and protection of personal and health information.

However, the provided information does not explicitly discuss the direct impact of this vulnerability on compliance with these regulations.

Useful 0 Not Useful 0