The vulnerability resides in the SendEmailAjax class of the LearnPress WordPress LMS Plugin. A missing capability check allows any authenticated user with Subscriber-level or higher privileges to bypass authorization controls and trigger email notifications to admins, instructors, or any site user. The result is email flooding, the potential for social engineering, and impersonation of administrative decisions regarding instructor requests. This weakness is classified as a Missing Authorization issue (CWE-862).

The affected product is the LearnPress plugin from ThimPress, a WordPress LMS plugin used to create and sell online courses. All plugin versions up to and including 4.3.2.8 are vulnerable; later releases (4.3.3 and above) contain the fix.

The CVSS score of 4.3 reflects a medium impact. Exploitation is unlikely to be widespread (EPSS <1%) and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation yet. Attackers need authenticated access via a Subscriber-level role or higher and can exploit the exposed AJAX endpoint by sending crafted requests containing a valid wp_rest nonce that is embedded in the front‑end JavaScript. Since the plugin executes the action without further authorization, the exposure can be leveraged for mass email delivery or targeted phishing campaigns.