CVE-2026-1787

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1787", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-03T01:03:46.808Z", "datePublished": "2026-02-21T10:37:17.153Z", "dateUpdated": "2026-04-08T17:02:34.129Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:34.129Z"}, "affected": [{"vendor": "thimpress", "product": "LearnPress \u2013 Backup & Migration Tool", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LearnPress Export Import \u2013 WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_migrated_data' function in all versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to delete course that have been migrated from Tutor LMS. The Tutor LMS plugin must be installed and activated in order to exploit the vulnerability."}], "title": "LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bde915d-092a-452b-a0e0-ce5c2ce203dc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.0/inc/Migration/Controllers/TutorMigrationController.php#L55"}, {"url": "https://plugins.trac.wordpress.org/changeset/3458589/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "baseScore": 4.8, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "timeline": [{"time": "2026-02-04T03:25:32.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-11T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T18:02:24.419546Z", "id": "CVE-2026-1787", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:03:03.057Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1787", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T18:02:24.419546Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:02:35.636Z"}}], "cna": {"title": "LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "thimpress", "product": "LearnPress \u2013 Backup & Migration Tool", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-04T03:25:32.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-11T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bde915d-092a-452b-a0e0-ce5c2ce203dc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.0/inc/Migration/Controllers/TutorMigrationController.php#L55"}, {"url": "https://plugins.trac.wordpress.org/changeset/3458589/"}], "descriptions": [{"lang": "en", "value": "The LearnPress Export Import \u2013 WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_migrated_data' function in all versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to delete course that have been migrated from Tutor LMS. The Tutor LMS plugin must be installed and activated in order to exploit the vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:34.129Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1787", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:34.129Z", "dateReserved": "2026-02-03T01:03:46.808Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-21T10:37:17.153Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LearnPress \u2013 Backup & Migration Tool", "vendor": "thimpress", "versions": [{"lessThanOrEqual": "4.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LearnPress Export Import \u2013 WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_migrated_data' function in all versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to delete course that have been migrated from Tutor LMS. The Tutor LMS plugin must be installed and activated in order to exploit the vulnerability."}, {"lang": "es", "value": "El LearnPress Export Import \u2013 extensi\u00f3n de WordPress para el plugin LearnPress para WordPress es vulnerable a la p\u00e9rdida de datos no autorizada debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n delete_migrated_data en todas las versiones hasta, e incluyendo, la 4.1.0. Esto hace posible que atacantes no autenticados eliminen cursos que han sido migrados desde Tutor LMS. El plugin Tutor LMS debe estar instalado y activado para explotar la vulnerabilidad."}], "id": "CVE-2026-1787", "lastModified": "2026-06-17T10:16:31.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1787", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T18:02:24.419546Z", "version": "2.0.3"}}]}, "published": "2026-02-21T11:15:55.813", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.0/inc/Migration/Controllers/TutorMigrationController.php#L55"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3458589/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bde915d-092a-452b-a0e0-ce5c2ce203dc?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "LearnPress \u2013 Backup & Migration Tool", "source": "cna", "vendor": "thimpress"}, "product": "learnpress_\u2013_backup_&_migration_tool", "vendor": "thimpress"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:07:06.737264+00:00", "value": {"mitigation_remediation": ["Update the LearnPress Export Import extension to the latest available version, or apply the vendor\u2011provided patch, to reinstate proper capability checks.", "If the site does not rely on Tutor LMS, uninstall or deactivate that plugin to remove the necessary prerequisite for exploitation.", "Verify that only privileged administrators possess the delete_migrated_data capability, review user role assignments, and eliminate any unauthorized links or functionalities that expose this capability to general users."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized deletion of courses migrated from Tutor LMS"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the thimpress LearnPress \u2013 Backup & Migration Tool plugin, all versions up to and including 4.1.0. Its exploitation requires the Tutor LMS plugin to be installed and activated on the target WordPress installation.", "description_and_impact": "The LearnPress Export Import extension performs a delete_migrated_data action without checking user permissions, allowing any visitor to trigger the function. This missing capability check leads to unauthorized removal of course content that was migrated from Tutor LMS, compromising data integrity and availability. The vulnerability is rooted in the lack of proper authorization controls (CWE\u2011862).", "risk_and_exploitability": "The CVSS v3 score of 4.8 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Attackers do not need any prior authentication; they simply need access to the site\u2019s front\u2011end or back\u2011end to trigger the vulnerable endpoint. The prerequisite of having Tutor LMS installed limits the affected audience, but once that condition is met, any visitor can delete migrated course data, potentially causing significant data loss."}}}}, "created": "2026-02-23T14:31:58.278440+00:00", "updated": "2026-04-15T18:15:10.823992+00:00", "vendors": ["thimpress", "thimpress$PRODUCT$learnpress_\u2013_backup_&_migration_tool", "wordpress", "wordpress$PRODUCT$wordpress"]}