The LearnPress plugin for WordPress contains a missing authorization flaw in the ‘search-authors’ AJAX action that allows any authenticated user with subscriber-level access or higher to enumerate the entire user roster. By submitting incremental search queries, the attacker receives a character‑by‑character response that can be used as an oracle against both the user_login and user_email database columns, revealing the full e‑mail address of every WordPress account, including administrators. This provides an attacker with sensitive personal information that can be leveraged for phishing, credential stuffing or further compromise.

LearnPress, a WordPress LMS plugin developed by thimpress, is affected in all releases up to and including version 4.4.10. Sites running this plugin have the vulnerability until the plugin is updated to a later version that removes the unchecked user‑role check in the AJAX handler.

The CVSS score of 6.5 indicates a medium severity vulnerability. Because a logged‑in user with subscriber privileges can trigger the flaw, the attack vector is restricted to authenticated sessions, and no additional network or local privileges are required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests that publicly known exploitation is currently limited. Even so, the ability to discover all user e‑mail addresses can facilitate targeted attacks and should be addressed promptly.