CVE-2025-66054CWE-862

WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability

High · published December 18, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

⚠️ An authorization hiccup in LearnPress could allow users to access content they shouldn't! Imagine an uninvited guest slipping into a VIP party because the bouncer forgot to check IDs. 🎉 Just like a bouncer who gets distracted and lets someone into a restricted area, this vulnerability lacks proper access control checks, meaning unauthorized users can waltz right in and view restricted content. This oversight could lead to unauthorized access, letting users view or manipulate sensitive educational materials without permission. Imagine someone accessing private quizzes or learning materials intended only for certain users—it could be a recipe for disaster!

Put simply

Just like a bouncer who gets distracted and lets someone into a restricted area, this vulnerability lacks proper access control checks, meaning unauthorized users can waltz right in and view restricted content. The missing authorization vulnerability in LearnPress allows misconfigured security levels to be exploited, meaning that users can bypass access controls that were meant to protect certain functionalities and data.

What to do

This oversight could lead to unauthorized access, letting users view or manipulate sensitive educational materials without permission. Imagine someone accessing private quizzes or learning materials intended only for certain users—it could be a recipe for disaster! To secure your LearnPress installation, upgrade to version 4.2.9.5 or later immediately. Additionally, review your access control settings to ensure they are properly configured to restrict access to sensitive content. 🛡️ You’ve got this! By following these steps, you'll strengthen your security and keep your content safe! 💪😊

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-18T07:22Z
EPSS history
Timeline
  • 18 DEC 07:22Z
    WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability
    cvelistv5