The LearnPress plugin for WordPress, in all versions up to 4.2.9.4, is vulnerable to sensitive information disclosure because the REST endpoint /wp-json/lp/v1/load_content_via_ajax lacks capability checks. This allows an unauthenticated attacker to invoke admin‑only template methods via arbitrary callbacks and retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other proprietary educational content. The flaw is a classic access‑control weakness that compromises data confidentiality.

The vulnerability affects the LearnPress – WordPress LMS Plugin developed by ThimPress. All releases through version 4.2.9.4 are impacted. Users running any of these versions on a WordPress site should consider the plugin as vulnerable.

The CVSS score is 5.3, indicating moderate severity. With an EPSS score of less than 1%, the current anticipated exploit probability is very low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need only network access to the site’s REST API and the ability to supply valid numeric identifiers to trigger the callback functions. Because no authentication is required and no special code execution is needed beyond data retrieval, exploitation is straightforward but constrained. The low exploitation probability means that the threat remains primarily a confidentiality risk rather than an immediate high‑impact incident.