The vulnerability resides in a capability check omission within LearnPress’s administrative course tool load_content_via_ajax. Attackers who do not need to be authenticated may send requests to the endpoint and receive a list of all enrolled students in a given course, including each student’s display name, user identifier, and email address. This results in the disclosure of personally identifiable information and is an example of improper access control and information exposure.

The affected environment is WordPress sites that use the LearnPress plugin version earlier than 4.4.7. No specific WordPress core versions are mentioned, but any site running a vulnerable LearnPress installation is susceptible.

EPSS indicates a very low likelihood of exploitation (<1%), and the issue is not listed in CISA KEV. Nonetheless, the feasible path to enumeration is a simple HTTP request to the admin endpoint; no authentication or privileged access is needed. The primary consequence is leakage of user information. While the low exploitation probability reduces urgency, the severity of the data disclosed still warrants timely remediation.