The vulnerability in ThimPress LearnPress results from a missing authorization check that allows an attacker to bypass configured access control security levels. If exploited, the attacker could gain the ability to read, modify, or delete learning content that should be restricted to certain user roles, potentially exposing confidential educational materials or corrupting course data.

This issue affects all installations of the LearnPress plugin from early versions through 4.4.9.1. Sites running WordPress with any of those plugin versions are at risk, regardless of the WordPress core version, because the access control flaw resides in the plugin code itself.

The CVSS score of 4.3 indicates moderate severity. No EPSS data is available, but the lack of a KEV listing suggests it is not a currently exploited vulnerability. The exploit likely requires web access to the plugin’s administrative or front‑end interfaces, but the description does not specify a particular attack vector, so this is inferred from the nature of the flaw.