The vulnerability resides in the LearnPress plugin's REST API. A missing capability check allows anyone who can send a request to the statistics endpoint to retrieve detailed order information, including total revenue and order status counts. This breach of data confidentiality grants unauthenticated attackers insight into the plugin's financial metrics.

All installations of the LearnPress – WordPress LMS Plugin for Create and Sell Online Courses up to and including version 4.3.1 are affected. The vendor is ThimPress, and the plugin is commonly used in WordPress sites that host online courses.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of 6% suggests a moderate probability that attackers will exploit this weakness. The plugin exposes a REST API endpoint that does not require authentication, allowing remote attackers to trigger the vulnerability by simply sending a GET request to the order statistics URL. While the vulnerability does not allow control over the host, it does expose sensitive operational data. The issue is not listed in the CISA KEV catalog, but given its moderate EPSS and public visibility on the WordPress plugin repository, an immediate patch is advised.