CVE-2025-14798

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14798", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-16T19:24:38.118Z", "datePublished": "2026-01-20T03:25:17.527Z", "dateUpdated": "2026-04-08T16:59:58.470Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:58.470Z"}, "affected": [{"vendor": "thimpress", "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.3.2.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LearnPress \u2013 WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.3.2.4 via the get_item_permissions_check function. This makes it possible for unauthenticated attackers to extract sensitive data including user first names and last names. Other information such as social profile links and enrollment are also included."}], "title": "LearnPress \u2013 WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb00ce4-aa82-4479-b7f6-79e7bde098c1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.1/inc/jwt/rest-api/version1/class-lp-rest-users-v1-controller.php#L134"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.1/inc/jwt/rest-api/version1/class-lp-rest-users-v1-controller.php#L35"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "timeline": [{"time": "2025-12-16T19:39:51.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-19T14:52:42.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T20:28:30.331731Z", "id": "CVE-2025-14798", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T20:28:45.838Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14798", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T20:28:30.331731Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T20:28:35.990Z"}}], "cna": {"title": "LearnPress \u2013 WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API", "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "thimpress", "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.3.2.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-16T19:39:51.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-19T14:52:42.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb00ce4-aa82-4479-b7f6-79e7bde098c1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.1/inc/jwt/rest-api/version1/class-lp-rest-users-v1-controller.php#L134"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.1/inc/jwt/rest-api/version1/class-lp-rest-users-v1-controller.php#L35"}], "descriptions": [{"lang": "en", "value": "The LearnPress \u2013 WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.3.2.4 via the get_item_permissions_check function. This makes it possible for unauthenticated attackers to extract sensitive data including user first names and last names. Other information such as social profile links and enrollment are also included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:58.470Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14798", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:59:58.470Z", "dateReserved": "2025-12-16T19:24:38.118Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-20T03:25:17.527Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses", "vendor": "thimpress", "versions": [{"lessThanOrEqual": "4.3.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LearnPress \u2013 WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.3.2.4 via the get_item_permissions_check function. This makes it possible for unauthenticated attackers to extract sensitive data including user first names and last names. Other information such as social profile links and enrollment are also included."}, {"lang": "es", "value": "El plugin LearnPress \u2013 WordPress LMS para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en versiones hasta la 4.3.2.4, inclusive, a trav\u00e9s de la funci\u00f3n get_item_permissions_check. Esto hace posible que atacantes no autenticados extraigan datos sensibles, incluyendo nombres y apellidos de usuario. Tambi\u00e9n se incluye otra informaci\u00f3n como enlaces de perfil social e inscripci\u00f3n."}], "id": "CVE-2025-14798", "lastModified": "2026-06-17T08:36:34.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14798", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T20:28:30.331731Z", "version": "2.0.3"}}]}, "published": "2026-01-20T04:15:57.667", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.1/inc/jwt/rest-api/version1/class-lp-rest-users-v1-controller.php#L134"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.1/inc/jwt/rest-api/version1/class-lp-rest-users-v1-controller.php#L35"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb00ce4-aa82-4479-b7f6-79e7bde098c1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T23:55:46.989330+00:00", "value": {"mitigation_remediation": ["Update the LearnPress plugin to a version newer than 4.3.2.4, which removes the unauthenticated access to the REST endpoint.", "If an immediate update is not possible, disable the LP REST Users v1 controller API endpoint or restrict it with a plugin or firewall rule that blocks unauthenticated REST calls to that route.", "Configure site\u2011wide access controls for REST API endpoints to ensure only authenticated users can access user data, using WordPress role capabilities or a security plugin."], "summary": {"action": "Patch", "impact": "Unauthenticated Sensitive Information Disclosure"}, "threat_synthesis": {"affected_systems": "The LearnPress \u2013 WordPress LMS Plugin for WordPress, versions up to and including 4.3.2.4, is affected. Users running any of these releases on WordPress sites are potentially vulnerable.", "description_and_impact": "The vulnerability in LearnPress \u2013 WordPress LMS Plugin allows an attacker without authentication to query a REST API endpoint, enabling extraction of user personal details such as first and last names, social profile links, and enrollment data. This is a classic case of missing authorization, classified under CWE-862, where the get_item_permissions_check function does not enforce sufficient access controls. The exposed data can compromise user privacy and may aid in further attacks or profiling.", "risk_and_exploitability": "The CVSS score of 5.3 places this flaw in the medium severity range, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability has not been listed in CISA\u2019s KEV catalog, indicating no known actively used exploitation. Attackers could exploit the publicly accessible REST API endpoint without credentials, making the attack vector network-visible and simple to trigger. Given these factors, the risk is moderate, but not negligible, and remediation should be prioritized."}}}}, "created": "2026-01-20T08:39:58.285646+00:00", "updated": "2026-04-22T00:00:03.952333+00:00", "vendors": ["thimpress", "thimpress$PRODUCT$learnpress", "wordpress", "wordpress$PRODUCT$wordpress"]}