The vulnerability arises from the plugin not verifying authentication or permissions when delivering an order export file. This flaw enables an attacker to readily learn sensitive customer data such as names, amounts, and guest email addresses, effectively bypassing privacy safeguards. The weakness is aligned with improper access control and information exposure, where data that should be protected can be accessed by any user who knows or guesses the download URL.

The issue affects the LearnPress WordPress plugin on all installations using versions earlier than 4.4.7. Any site running an affected build of this plugin exposes its order export functionality to unauthenticated users. No specific platform or hosting environment constraints are noted beyond the plugin requirement.

Attackers can exercise this flaw by sending an ordinary HTTP request to the order export endpoint, which the plugin serves without any authentication or permission checks. Because the endpoint identifier is predictable or guessable once known, obtaining the raw order data is straightforward. The EPSS score for this vulnerability is below 1% and it is not listed in CISA KEV, indicating a low probability of active exploitation at the moment. Nevertheless, any site running a vulnerable LearnPress plugin could inadvertently expose customer names, purchase details, amounts and guest email addresses if the export files are accessed without restriction.