The vulnerability is a missing authorization flaw that allows attackers to bypass the access control hierarchy of the LearnPress plugin. An unauthorized user could potentially view, edit, or delete restricted course material, change enrollment settings, or otherwise take actions that should be limited to privileged users. The weakness maps directly to CWE-862, which signifies a failure to enforce proper authorization checks when processing a request.

The flaw affects all installations of the ThimPress LearnPress plugin up to and including version 4.4.11. The issue was discovered across all distribution channels that provide the plugin in the stated versions, with no mitigation present in versions prior to 4.4.12.

With a CVSS score of 5.3, the vulnerability represents moderate severity. The EPSS score is currently unspecified, and the vulnerability is not listed in the CISA KEV catalog, indicating that there is no documented exploitation in the wild. The attack vector is not explicitly described in the available data; however, the nature of an access control flaw suggests that the attacker must be able to reach the plugin’s administrative interfaces, whether through an authenticated session or a misconfigured public endpoint. The absence of mitigation details implies that exploitation may be feasible if an attacker can reach those interfaces, though no active exploitation campaigns have been reported.