CVE-2026-8383 LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API
Unauthenticated attackers can retrieve sensitive user information including roles and capabilities via an unprotected REST API endpoint in the LearnPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8383?
CVE-2026-8383 is a medium-severity missing authorization vulnerability in Unknown LearnPress, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request
Weakness: CWE-862
Which versions are affected by CVE-2026-8383?
How do I fix CVE-2026-8383?
No fix has been published for CVE-2026-8383 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-8383 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8383 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-5c22-cxr9-3pjc.