The LearnPress plugin exposes sensitive data through the public JSON API endpoint. By supplying the query parameters c_status=all and return_type=json to /wp-json/lp/v1/courses/archive-course, an unauthenticated user can trigger a SELECT * query that returns the plain‑text password of password‑protected courses as well as the full post content, author, and slug of courses that are in draft, private, or pending state. This constitutes a direct disclosure of confidential course information and credentials.

The vulnerability affects the thimpress LearnPress WordPress LMS plugin for all releases up to and including version 4.3.6. WordPress sites that actively use these plugin versions are at risk; newer releases beyond 4.3.6 are presumed patched.

The CVSS score of 5.3 indicates moderate severity, and the exploit is feasible over the network through a simple HTTP request to the REST endpoint. No authentication is required, making the attack surface wide. Because the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is uncertain, but the lack of gating mechanisms allows any internet‑exposed WordPress installation to expose sensitive data.