ThimPress LearnPress Plugin up to 4.3.6 on WordPress archive-course return_type authorization

Summaryinfo

A vulnerability, which was classified as problematic, has been found in ThimPress LearnPress Plugin up to 4.3.6 on WordPress. This affects an unknown part of the file /wp-json/lp/v1/courses/archive-course. The manipulation of the argument return_type leads to authorization. This vulnerability is documented as CVE-2026-8502. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in ThimPress LearnPress Plugin up to 4.3.6 on WordPress and classified as problematic. This issue affects an unknown functionality of the file /wp-json/lp/v1/courses/archive-course. The manipulation of the argument return_type with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. The summary by CVE is:

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the 'return_type' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the plaintext post_password of password-protected courses and the full post_content, post_author, and post_name of unpublished draft, private, and pending courses via the unrestricted SELECT * fallback query. Exploitation requires supplying both c_status=all (to bypass the publish-only post_status WHERE clause) and return_type=json (to prevent the safe DISTINCT(ID) AS ID field override) in a single unauthenticated request to the /wp-json/lp/v1/courses/archive-course endpoint.

The weakness was released by Jamshed Yergashvoyev. The advisory is shared at wordfence.com. The identification of this vulnerability is CVE-2026-8502 since 05/13/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 4.3.2.8 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-34952). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• ThimPress

Name

• LearnPress Plugin

Version

• 4.3.0
• 4.3.1
• 4.3.2
• 4.3.3
• 4.3.4
• 4.3.5
• 4.3.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion