CVE-2026-78125
N/A
N/A
Summary
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | LearnPress | 0 < 4.0.3 | affected |
Weaknesses
- CWE-200 Information Exposure
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.