CVE-2026-7565
Arbitrary File Read in LearnPress Backup & Migration Tool
Publication date: 2026-06-06
Last updated on: 2026-06-06
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| thimpress | learnpress | to 4.1.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The LearnPress – Backup & Migration Tool plugin for WordPress has a vulnerability known as Arbitrary File Read via Directory Traversal. This affects all versions up to and including 4.1.4. The vulnerability exists through the 'import-user-file' parameter, which allows an authenticated attacker with administrator-level access or higher to read the contents of arbitrary files on the server.
This means that an attacker can exploit this flaw to access sensitive files on the server that they should not normally be able to read.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker with administrator-level access to read sensitive files on your server. These files may contain confidential information, which could lead to data exposure or leakage.
Since the attacker needs administrator-level access, the risk is limited to users who already have high privileges, but it still poses a significant threat to the confidentiality of your data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with administrator-level access to read arbitrary files on the server, which may include sensitive information.
This exposure of sensitive data could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.