The LearnPress WordPress plugin, prior to version 4.4.7, fails to verify a user's capabilities before applying a user supplied post status filter in a REST route. This oversight allows an unauthenticated attacker to enumerate courses that are not publicly visible, including those in draft, pending, private, scheduled, and trashed states. The primary impact is the exposure of sensitive or confidential course content to anyone who can access the plugin's API endpoint, potentially leaking intellectual property or personal data stored in course materials. The weakness is a classic access control flaw that permits information disclosure without authorization.

LearnPress plugin for WordPress installations using any version before 4.4.7. No specific WordPress core or other product versions are cited; the vulnerability is confined to the LearnPress plugin code itself.

The EPSS score indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in CISA KEV. The CVSS score is not provided in the available data, but the lack of authentication requirements suggests a moderate severity for systems where course confidentiality is critical. The likely attack vector is through the public REST API endpoint exposed by LearnPress, which can be reached without authentication. An attacker can craft requests with a status filter and view the results directly, exposing unpublished course content.