The vulnerability is a Missing Authorization flaw in the ThimPress LearnPress plugin, enabling users to exploit incorrectly configured access control security settings. This flaw permits the bypass of intended authorization checks, allowing an attacker to gain unauthorized access to protected functionality or data that should be restricted by the plugin. Such abuse can compromise the confidentiality, integrity, or availability of course content and user information within the WordPress site.

The affected product is the ThimPress LearnPress WordPress plugin, all versions up to and including 4.4.12. The vulnerability does not affect later releases (4.4.13 and beyond).

The CVSS v3 score of 5.4 indicates moderate severity, primarily due to the medium impact and lack of elevated privileges required. The EPSS score is not available, so the public exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, which suggests no confirmed widespread exploitation to date. While the attack vector is not explicitly disclosed, it can be inferred that the flaw likely requires authenticated access to the WordPress admin area where the LearnPress plugin operates, or possibly unauthenticated access to the plugin's exposed functionality.