CVE-2026-75982 LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
Authenticated Editors can modify arbitrary WordPress options via the create_page AJAX action, potentially enabling public registration or breaking site functionality.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-75982?
CVE-2026-75982 is a medium-severity missing authorization vulnerability in thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses, published on 25 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.
Weakness: CWE-862
Which versions are affected by CVE-2026-75982?
How do I fix CVE-2026-75982?
No fix has been published for CVE-2026-75982 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-75982 being exploited?
There is no known exploitation of CVE-2026-75982 in the wild and no public exploit code.
Sources
Also known as GHSA-2qx9-4rjh-4r9j.