The LearnPress plugin for WordPress contains a missing authorization check that allows an attacker with insufficient privileges to access or perform actions that should be restricted. Because the plugin does not enforce correct access control, an unauthorized user could potentially enroll in courses, modify enrollment data, or otherwise manipulate course configurations, leading to unauthorized changes or data exposure.

The vulnerability affects all installations of the ThimPress LearnPress plugin up to and including version 4.4.11. Any WordPress site that has LearnPress 4.4.11 or an earlier release is impacted.

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score is not available. This issue is not listed in the CISA KEV catalog, suggesting no current widespread exploitation. The likely attack vector is a remote web‑based request, with an attacker leveraging normal plugin URLs or API endpoints to exploit the missing authorization control. The CWE identifier for this weakness is CWE‑862, indicating an access control flaw.