This vulnerability is a missing authorization flaw that permits an attacker to exploit incorrectly configured access control security levels in the ThimPress LearnPress plugin. The flaw allows a user to gain access to functions or data that should be restricted, effectively bypassing normal privilege checks. It is classified under CWE-862, indicating an authorization error. The impact is the unauthorized escalation of privileges or exposure of sensitive information, potentially compromising site security.

WordPress sites that run the LearnPress plugin through version 4.2.9.4 and earlier are vulnerable. The flaw applies to all installations of the LearnPress plugin whose version is not newer than 4.2.9.4; any additional custom configuration that lowers the intended security level may also be affected.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of < 1% shows that exploitation is currently considered unlikely. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is via authorized or partially authorized requests that target plugin pages or API endpoints where the access control logic is defective. An attacker would need to be able to act within the WordPress system and exploit the lack of proper authorization checks to elevate privileges or access restricted content.