What is CVE-2026-12976?
In LearnPress WordPress plugin versions before 4.4.4, the AI assistant feature does not verify course enrollment, allowing any authenticated user like a subscriber to access materials from paid courses they haven't enrolled in. This is an authorization bypass vulnerability. Updating to version 4.4.4 or later is required.
Azərbaycanca: LearnPress WordPress plugininin 4.4.4-dən əvvəlki versiyalarında autentifikasiya olunmuş istənilən istifadəçi (məsələn, abunəçi), qeydiyyatdan keçmədiyi ödənişli kursların dərs məzmununa AI köməkçisi sorğuları vasitəsilə daxil ola bilir. Bu, kurs məzmununun qorunması mexanizminin zəifliyidir. İstifadəçilər plugin-i ən azı 4.4.4 versiyasına yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-862
FAQ2
Which users can access protected course content through CVE-2026-12976 in the LearnPress plugin?
Any authenticated user, such as a subscriber, can access materials from paid courses they haven't enrolled in.
What version of the LearnPress WordPress plugin fixes the vulnerability CVE-2026-12976?
Updating to version 4.4.4 or later is required.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.