CVE-2026-8383: Unknown Learnpress

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request

Affected products

• Unknown Learnpress: before 4.3.7 (fixed in 4.3.7)

Published 2026-06-17. Last modified 2026-06-17.