The vulnerability exists in the LearnPress WordPress plugin before version 4.4.7. An administrative template handler that serves quiz question data does not verify the requesting user’s capabilities, allowing callers to freely retrieve the text, identifier, and type of every published quiz question, as well as perform keyword searches over the entire question bank. Because this content is normally kept non‑public, an unauthenticated user can obtain sensitive educational material without permission, exposing potential intellectual property and user data. The weakness aligns with CWE‑200 Information Exposure and CWE‑284 Insecure Permissions, indicating that adequate access control is missing.

Any WordPress site that has installed LearnPress before version 4.4.7 is affected. The plugin versions that lack the capability checks include all releases prior to 4.4.7; users must verify their current plugin version to determine exposure.

The EPSS score is less than 1%, implying a very low exploitation probability at the time of this analysis, and the vulnerability is not listed in CISA’s KEV catalog. However, because the attack requires no authentication and can be performed simply by sending a request to the load_content_via_ajax endpoint, an attacker could obtain the entire quiz bank by accessing the site publicly or through a scripted crawler. Without the proper access check the user request is treated as an authorized read, leading to an uncontrolled disclosure of content.