The vulnerability in LearnPress – WordPress LMS Plugin allows an attacker without authentication to query a REST API endpoint, enabling extraction of user personal details such as first and last names, social profile links, and enrollment data. This is a classic case of missing authorization, classified under CWE-862, where the get_item_permissions_check function does not enforce sufficient access controls. The exposed data can compromise user privacy and may aid in further attacks or profiling.

The LearnPress – WordPress LMS Plugin for WordPress, versions up to and including 4.3.2.4, is affected. Users running any of these releases on WordPress sites are potentially vulnerable.

The CVSS score of 5.3 places this flaw in the medium severity range, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability has not been listed in CISA’s KEV catalog, indicating no known actively used exploitation. Attackers could exploit the publicly accessible REST API endpoint without credentials, making the attack vector network-visible and simple to trigger. Given these factors, the risk is moderate, but not negligible, and remediation should be prioritized.