CVE Explorer
CVE-2026-3226
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check before dispatching to handler functions. The wp_rest nonce is embedded in the frontend JavaScript for all authenticated users. This makes it po
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"LearnPress – WordPress LMS Plugin for Create and Sell Online Courses","vendor":"thimpress","versions":[{"lessThanOrEqual":"4.3.2.8","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:bea81017f65ef70ef395b8d2079822afdca5d14b4dbf2a8c08201e94d2a70279 · sha256:ac1597ee8574f367… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:bea81017f65ef70ef395b8d2079822afdca5d14b4dbf2a8c08201e94d2a70279 · sha256:ac1597ee8574f367… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:bea81017f65ef70ef395b8d2079822afdca5d14b4dbf2a8c08201e94d2a70279 · sha256:ac1597ee8574f367… · /containers/cna/problemTypes/0/descriptions/0
Source references
5 source assertions{"url":"https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/Ajax/AbstractAjax.php#L17"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:bea81017f65ef70ef395b8d2079822afdca5d14b4dbf2a8c08201e94d2a70279 · sha256:ac1597ee8574f367… · /containers/cna/references/3
{"url":"https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/Ajax/SendEmailAjax.php#L40"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:bea81017f65ef70ef395b8d2079822afdca5d14b4dbf2a8c08201e94d2a70279 · sha256:ac1597ee8574f367… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.7/inc/class-lp-assets.php#L123"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:bea81017f65ef70ef395b8d2079822afdca5d14b4dbf2a8c08201e94d2a70279 · sha256:ac1597ee8574f367… · /containers/cna/references/1
{"url":"https://plugins.trac.wordpress.org/changeset?old_path=/learnpress/tags/4.3.2.7/inc/Ajax/SendEmailAjax.php&new_path=/learnpress/tags/4.3.3/inc/Ajax/SendEmailAjax.php"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:bea81017f65ef70ef395b8d2079822afdca5d14b4dbf2a8c08201e94d2a70279 · sha256:ac1597ee8574f367… · /containers/cna/references/4
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/520018db-d33b-4f2c-aaa5-611de792e11f?source=cve"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:bea81017f65ef70ef395b8d2079822afdca5d14b4dbf2a8c08201e94d2a70279 · sha256:ac1597ee8574f367… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.