The vulnerability in ThimPress LearnPress results from a missing authorization check that allows an attacker to bypass configured access control security levels. If exploited, the attacker could gain the ability to read, modify, or delete learning content that should be restricted to certain user roles, potentially exposing confidential educational materials or corrupting course data. Versions affected are from the initial release through 4.4.10.

This issue affects all installations of the LearnPress plugin from early versions through 4.4.10. Sites running WordPress with any of those plugin versions are at risk, regardless of the WordPress core version, because the access control flaw resides in the plugin code itself.

The CVSS score of 4.3 indicates moderate severity. EPSS score is <1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in KEV. The exploit likely requires web access to the plugin’s administrative or front‑end interfaces, but the description does not specify a particular attack vector, so this is inferred from the nature of the flaw.