LearnPress WordPress plugin versions prior to 4.0.3 expose a REST API endpoint that accepts an order identifier without performing an authorization check. An attacker can use this endpoint to retrieve the payment status of any order simply by supplying its identifier, revealing sensitive information about transactions. The weakness is a classic unauthorized read of protected data.

WordPress sites running the LearnPress plugin with version 4.0.2 or earlier are affected. Any installation that has not upgraded to a release newer than 4.0.2, regardless of additional authentication mechanisms elsewhere on the site, remains vulnerable.

The REST endpoint is publicly accessible, and no authentication is required to query an order’s status. Because of this, an attacker can enumerate order identifiers (e.g., by trial and error or using known patterns) to harvest status information remotely. The EPSS score is <1% and the CVSS score of 5.3 indicates medium severity. The vulnerability is not listed in the CISA KEV catalog, indicating that the exploitation probability is currently unknown. The impact is strictly information disclosure; no additional malicious activity is described by the CVE entry.