ThimPress LearnPress Plugin up to 4.4.4 on WordPress AJAX Action create_page field_name privileges management

Summaryinfo

A vulnerability categorized as problematic has been discovered in ThimPress LearnPress Plugin up to 4.4.4. This impacts the function LP_Admin_Ajax::create_page of the component AJAX Action. The manipulation of the argument field_name results in privileges management. This vulnerability is known as CVE-2026-75982. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in ThimPress LearnPress Plugin up to 4.4.4. Affected is the function LP_Admin_Ajax::create_page of the component AJAX Action. The manipulation of the argument field_name with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on integrity, and availability. CVE summarizes:

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.

The advisory is shared for download at wordfence.com. This vulnerability is traded as CVE-2026-75982 since 08/18/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/25/2026). The MITRE ATT&CK project declares the attack technique as T1068.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Vendor

• ThimPress

Name

• LearnPress Plugin

Version

• 4.4.0
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion