CVE-2026-8383

MediumPublished

LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API

Published: Jun 17, 2026
Updated: Jun 17, 2026
Assigning CNA: WPScan

Primary CVSS

5.3/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS probability estimate

0.7%

Low · next 30 days

Percentile: 52.2%
Model date: Oct 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

LearnPress < 4.3.7 - Information DisclosureTemplate
http/cves/2026/CVE-2026-8383.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 1f4c3f6568abRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.