Missing Authorization vulnerability in ThimPress LearnPress LearnPress allows the exploitation of incorrectly configured access control security levels, potentially permitting users to perform actions beyond their intended permissions. This flaw qualifies as a broken access control issue, creating a pathway for attackers to gain unauthorized access to features and data handled by the plugin.

The vulnerability affects the ThimPress LearnPress WordPress plugin versions from unspecified earliest releases through 4.2.7.5. Consequently, any site running LearnPress within this version range is at risk and should verify the installed version.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS rating of less than 1% suggests that the likelihood of exploitation is currently very low; the vulnerability is also not listed in CISA’s KEV catalog. Attack vector information is not explicitly provided in the CVE documentation, so it is inferred that exploitation would require either authenticated access or an environment where security levels are misconfigured, allowing an attacker to misuse plugin functionality.