CVE-2026-75982
Received Received - Intake

Unauthorized Option Modification in LearnPress WordPress Plugin

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Wordfence

Description
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-75982
EUVD
EUVD-2026-65272

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thimpress learnpress to 4.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The LearnPress plugin for WordPress has a vulnerability in versions up to 4.4.4 that allows unauthorized modification of WordPress options. An attacker with Editor-level access can exploit the learnpress_create_page AJAX action to change site settings by updating arbitrary options to a positive integer, such as enabling public registration or breaking the site.

Detection Guidance

Check for unauthorized changes to WordPress options by reviewing recent updates to site-wide settings like users_can_register or active_plugins. Inspect logs for suspicious AJAX requests to learnpress_create_page with Editor-level access.

Impact Analysis

If exploited, this vulnerability could allow attackers to modify critical WordPress settings, such as enabling public user registration, corrupting active plugins, or altering site-wide configurations. This could lead to unauthorized user access, site disruption, or further compromise of the WordPress installation.

Compliance Impact

This vulnerability could lead to unauthorized changes in user registration settings, potentially violating GDPR or HIPAA requirements for access control and data protection. Unauthorized modifications to site settings may result in non-compliance with these regulations.

Mitigation Strategies

Update the LearnPress plugin to the latest version beyond 4.4.4. Temporarily restrict Editor roles from accessing AJAX actions. Review and revert any unauthorized option changes in WordPress settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75982. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart