CVE-2026-107744Published
LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-107744 · Microsoft / collected KEV context
cve-program · CVE-2026-107744
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d1894596-b430-41b3-9d28-12c7dea7ff9b?source=cve
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php#L105
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php#L80
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-request-handler.php#L173
- https://plugins.trac.wordpress.org/changeset/3750011/learnpress/trunk/inc/admin/class-lp-admin-ajax.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.