A missing authorization check in the LearnPress plugin allows an attacker to perform actions that should be restricted to privileged users. The vulnerability, classified as broken access control (CWE‑862), can expose sensitive course content, administrative controls, and user data to unauthorized parties. Attackers may exploit this flaw to view or modify protected learning materials, enroll in courses, or alter course enrollment settings.

Affected systems are WordPress installations that use the ThimPress LearnPress plugin up to version 4.4.10. The issue applies from the earliest installed version through 4.4.10, so any site running a vulnerable version of the plugin is at risk.

The CVSS score is 5.4, indicating a medium impact if exploited. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation likely occurs via a web request to the plugin’s endpoints without requiring initial authentication, meaning that an attacker with internet access to the site could leverage the flaw. The overall risk remains moderate, but systems administrators should be cautious until the plugin is updated.