A vulnerability affecting the LearnPress plugin through version 4.4.10 allows a subscriber or authenticated user to access or modify content belonging to other users. The flaw is a broken access‑control issue described by CWE‑862, enabling unauthorized retrieval or manipulation of protected data by exploiting insufficient permission checks. This could lead to privacy violations or data integrity problems for site owners and learners.

The threat applies to installations of the ThimPress LearnPress WordPress plugin with versions up to and including 4.4.10. No other vendors or product lines are listed in the CNA data.

The CVSS score is 5.4, indicating a moderate risk. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need a valid learner account or other authenticated role within the plugin; the exact nature of the access bypass is not fully detailed in the advisory, so the likelihood of exploitation is uncertain. Because the plugin is widely used in e‑learning environments, an unpatched site could experience unauthorized data exposure if compromised. Advisers recommend evaluating the severity in the context of user roles and data sensitivity present on the site.