The LearnPress Export Import extension performs a delete_migrated_data action without checking user permissions, allowing any visitor to trigger the function. This missing capability check leads to unauthorized removal of course content that was migrated from Tutor LMS, compromising data integrity and availability. The vulnerability is rooted in the lack of proper authorization controls (CWE‑862).

The vulnerability affects the thimpress LearnPress – Backup & Migration Tool plugin, all versions up to and including 4.1.0. Its exploitation requires the Tutor LMS plugin to be installed and activated on the target WordPress installation.

The CVSS v3 score of 4.8 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers do not need any prior authentication; they simply need access to the site’s front‑end or back‑end to trigger the vulnerable endpoint. The prerequisite of having Tutor LMS installed limits the affected audience, but once that condition is met, any visitor can delete migrated course data, potentially causing significant data loss.