Security Alert Summary
The LearnPress WordPress plugin contains a vulnerability that allows unauthenticated attackers to retrieve the payment status of arbitrary orders by enumerating order identifiers. The issue stems from a REST endpoint that does not perform authorization checks in affected versions.
CVE Details
- CVE ID: CVE-2026-78125
- Affected component: LearnPress WordPress plugin
- Affected versions: Versions before 4.0.3 (all versions up to and including 4.0.2 are reported affected)
- Published date: August 27, 2026 at 6:17:29 AM UTC
- Last modified date: August 27, 2026 at 6:17:29 AM UTC
- CVSS v3.1: Not provided in source data
- Authentication required: No (unauthenticated access allowed per description)
- Privileges required: None
- User interaction: None required
- Primary impact: Confidentiality – disclosure of order payment status; Integrity – none indicated; Availability – none indicated
- CWE / weakness ID: Not specified in provided data
Technical Details
According to the provided description, a LearnPress REST API endpoint in versions before 4.0.3 does not perform any authorization check. Because the endpoint lacks proper authorization, unauthenticated attackers can enumerate order identifiers and obtain the payment status for arbitrary orders. The disclosure is limited to the data the endpoint returns; the report specifically cites payment status disclosure.
The root cause is a missing authorization check on a REST endpoint. No specific function names or endpoint paths are provided in the source data. The impact is information disclosure: an attacker can learn whether a specific order is marked as paid or unpaid, which can inform further reconnaissance or social engineering.
How This Could Impact Your Website
In a typical small business WordPress site using LearnPress, multiple people interact with the site: the site owner, internal staff such as course managers, and external contractors or contributors. If an attacker can enumerate order identifiers and retrieve payment status, they could build a list of paid or unpaid orders. While this vulnerability, as described, discloses payment status rather than customer contact details, the information could still be used to craft targeted phishing or social engineering campaigns against customers or staff.
For example, an attacker who knows which orders are unpaid might impersonate support or billing to solicit payment details, or use payment-status information to prioritize targets for fraud. If other endpoints or plugins expose customer contact details, the risk from this information disclosure increases.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin to version 4.0.3 or later if that version is available for your installation, or apply the vendor-provided fix once it is released.
- Review and reduce unnecessary user roles and capabilities, especially for contributor-level and external accounts.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins and themes to reduce your attack surface.
- Monitor site activity and logs for unusual behavior that might indicate automated enumeration or probing of REST endpoints.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
